A 33-year-old British-Nigerian man, Idris Dayo Mustapha, has admitted to participating in a hacking ring that defrauded and stole over $6 million from U.S. firms between 2011 and 2018.

Mustapha, a dual national of the UK and Nigeria, was extradited from the UK in August, two years after his initial arrest. The hacking operation involved infiltrating email and brokerage accounts, resulting in significant financial losses for the targeted companies.

Mustapha is facing a potential prison sentence of up to 20 years for his crimes. He recently pleaded guilty in a Brooklyn, New York court to four charges, including computer intrusion, securities fraud, wire fraud, and access device fraud.

The charges stem from his involvement in hacking the computer servers of U.S. financial institutions, enabling unauthorized access to confidential user data, including personal identifying information. As of now, he awaits sentencing, according to the BBC.

Members of the hacking ring, including Mustapha, exploited the stolen information and passwords to wire funds and transfer securities from victims’ accounts to accounts controlled by the perpetrators.

The hacked accounts were used to conduct unauthorized stock trades without the account holder’s knowledge. U.S. authorities had been actively pursuing Mustapha for several years before his recent guilty plea in a New York court.