The group, known as the Infraud Organization, were charged with nine counts, including conspiracy to racketeer, wire fraud, and computer crimes.
The group acquired, sold, and disseminated stolen identities, compromised credit and debit cards, and other financial and personal information.
An indictment filed in Las Vegas detailing the charges was unsealed Wednesday, said the group's alleged administrator and founder, Svyatoslav Bondarenko, who created the forum on the dark web in 2010. The indictment said the founder billed the forum as the "premier destination for carding, and to 18 direct traffic and potential purchasers to the automated vending sites of its members, which serve as online instruments that traffic in stolen means of identification, personally-identifying information, stolen financial and banking information, and other illicit goods."
Prosecutors said that the Bondarenko, a Ukrainian national, dropped off the site's radar in 2015.
Dubbed "Operation Shadow Web," the criminal group's server was taken offline following cooperation from British, Australian, EU and Asian law enforcement groups.
As of about a year ago, there were more than 10,900 members on the group's forum, the indictment says.
In a media call following the indictment unsealing, deputy assistant attorney general David Rybicki called the case "one of the largest cyber fraud enterprise prosecutions ever undertaken" by the Justice Department.
Prosecutors claim the three-dozen alleged scammers intended to generate upwards of $2.2 billion in stolen revenue from consumers, businesses, and financial institutions.
Justice Dept. officials said five of the named defendants were from the US, and eight defendants have been arrested and are pending extradition from the UK, Australia, France, Italy, Kosovo and Serbia.
The rest of the suspects remain at large, said prosecutors.
Not all the members' names are known, however. One of the suspects' names was deliberately redacted.
The indictment lists 117 separate acts of criminality from the named Infraud members, including hosting sites storing dumps of credit card, and buying and selling stolen information, including 795,000 HSBC banking logins.
John P. Cronan, acting assistant attorney general for the Justice Dept.'s Criminal Division, said the Infraud members "operated like a business to facilitate cyberfraud on a global scale."
"Criminal cyber organizations like Infraud threaten not just U.S. citizens but people in every corner of the globe," said Derek Benner, acting executive associate director of US Immigration and Customs Enforcement's Homeland Security Investigations unit.
The defendants face upwards of 30 years in prison on all counts.