SEATTLE: The son of a Russian lawmaker has been convicted of hacking into US businesses to steal credit card information and orchestrating an international online theft scheme that netted him millions of dollars.

Jurors deliberated over two days before finding Roman Seleznev guilty Thursday of 38 charges, including nine counts of hacking and 10 counts of wire fraud. He could face up to 40 years in prison when he's sentenced Dec. 2, and he still faces similar charges in federal courts in Nevada and Georgia, his attorney said.

His lawyer, John Henry Browne, vowed to appeal, saying a key issue will be Seleznev's 2014 arrest by US Secret Service agents in the Maldives that he called a kidnapping. The defense had tried to challenge the arrest, but the judge banned the issue at trial.

Agents captured Seleznev as he and his girlfriend arrived at the island country's airport on their way to Russia. They flew him by private jet to Guam and then to Seattle, where he is in custody.

Seleznev hacked into businesses, mostly pizza restaurants in Washington state, and stole millions of credit card numbers that he sold on underground internet forums, authorities said. The thefts led to almost $170 million in credit card losses around the world and made him "one of the most prolific credit card traffickers in history," prosecutors said.

Seleznev was indicted in 2011, but a month later, he suffered a brain injury in a terrorist bombing in a cafe in Morocco. He was in a coma for two weeks and underwent a series of operations, according to a previous lawyer.

Prosecutors added 11 new counts in 2014, including wire and bank fraud, hacking and identity theft.

Sitting at his keyboard in Vladivostok, Russia, and using the online nicknames "Track2," ''Bulba" and "2Pac," Seleznev masterminded a scheme dating to 2008, Assistant US Attorney Norman Barbosa said during closing arguments Wednesday.

The defense focused on challenging the evidence from Seleznev's laptop, seized by Secret Service agents during his arrest. His lawyers claim the agents mishandled the computer and failed to adequately secure it.

The defense's only witness testified that the machine may have been tampered with, and the attorneys said any evidence from it was suspect. They also said prosecutors failed to make a solid link between the hacks and Seleznev.

The investigation started in 2010 when an Idaho deli was hacked. Over time, agents linked the computer viruses used to steal the credit card data to computer servers where the numbers were stored. They connected those servers to Seleznev through online nicknames and other sites he frequented.

When he was arrested, agents found 1.7 million stolen credit cards on his laptop, along with the passwords to access the servers, prosecutors said.