Authorities have called the scheme "securities fraud on cyber-steroids."

Joshua Samuel Aaron, an American living in Moscow, was arrested Wednesday at JFK Airport in New York. He returned to face charges he stole contact information for more than 100 million customers of JPMorgan and other U.S. financial institutions and companies. Aaron, 32, later pleaded not guilty to a 22-count indictment. His co-defendants, Gery Shalon and Ziv Orenstein, who were arrested by Israeli authorities in 2015, had pleaded not guilty, as well.

The prosecution was announced last year by U.S. Attorney Preet Bharara, who said the trio had conspired to carry out “the single largest theft of customer data from a U.S. financial institution ever.” Bharara said thieves took data on more than 83 million customers of JPMorgan Chase in 2014, and Aaron was charged with working to hack into the networks of dozens of American companies.

If convicted of the charges, the defendants could face decades in prison.