Two Delaware men of Nigerian descent has been sentenced to a combined 189 months in U.S. prison for their roles in an international cyber intrusion scheme.

According to public documents and evidence presented at sentencing, for nearly two years, Chijioke Odimegwu, 25, and Harafat Mogaji, 26, both of whom were members of the United States Air Force at the time, attacked business victims across the U.S. with email “spamming” and phishing campaigns to steal usernames and passwords for victims’ employee email accounts.

They were sentenced on Friday, according to a statement by Department of Justice.

Mr Odimegwu was sentenced to a term of imprisonment of 111 months and ordered to pay restitution in the amount of $366,617.59. Mr Mogaji was sentenced to a term of imprisonment of 78 months and ordered to pay restitution in the amount of $995,680.45.

Both were taken into custody following sentencing. After completing their prison terms, Messrs Odimegwu and Mogaji will each serve a three-year term on supervised release.

They and their co-conspirators then used these stolen credentials, along with “spoofed” email addresses mimicking emails associated with the victim or its business partners, to communicate with their victims and redirect payments to and from the victims’ trusted business partners to accounts controlled by the defendants’ co-conspirators.

Working with co-conspirators both in the U.S. and abroad, Messrs Odimegwu and Mogaji fraudulently diverted a more than $1.68 million wire sent by a victim in Iowa City, Iowa, to a bank account in Chicago controlled by the conspiracy.

They also diverted a more than $720,000 wire sent by a victim in Ohio to a bank account controlled by the conspiracy. These are in addition to many other attempts Messrs Odimegwu and Mogaji made to divert wire transfers made by businesses in Iowa and across the country.

As part of their spamming and phishing campaigns, Messrs Odimegwu and Mogaji also harvested financial information from victims, such as financial account numbers and information, personal identification numbers, and credit and debit card numbers, including credit card information for a victim non-profit located in Pella, Iowa.

They also purchased similar stolen information from their co-conspirators. They would then use the stolen information to make and attempt financial transactions without their victims’ knowledge or authorisation. They exchanged this information with one another and attempted to make purchases using that information stolen from other victims across the country.