A Russian man, charged for his part in a massive credit card heist, now faces additional criminal counts related to a point-of-sale (POS) hacking incident.

On Wednesday, a federal grand jury in Seattle brought 11 more counts against Roman Seleznev. The now 40-count indictment details his involvement in the “theft and sale of more than 2 million credit card numbers,” the Department of Justice said in a release.

Seleznev, 30, was arrested in July for hacking crimes at Washington, D.C. restaurants, including an attack on Broadway Grill in 2010. The exploits involved Seleznev hacking into retailer POS systems and installing malware to steal card numbers.

In August, Seleznev was ordered to remain in federal custody until his trial, despite a plea by the Russian Foreign Ministry to have him released. Seleznev is the son of Russian lawmaker Valery Seleznyov.