"They came in quickly, started stealing, and were out before law enforcement had a grasp of what happened," said Secret Service Asst. Special Agent Tim Hollern, who works at the Honolulu field office.

But a new Hawaii law called the Long-Arm Statute now requires out-of-state companies to hand over online records to investigators.

The very network that netted those stolen numbers is now arming investigators with the evidence to bring criminals down.

"We were able to obtain pictures of one of the defendants standing on the balcony of the Trump Hotel in Waikiki," said van Marter.

"The indications of this group are they are active in other areas and internationally," said Hollern.

Two of the suspects were caught Friday morning.

Two others will soon be extradited from Aruba, where they fled to, back to Hawaii.

The first suspect caught will be in court on Feb. 14.

Another change to Hawaii law in 2012 means the penalty for many cyber and white collar crimes has doubled.

Conviction for identity theft can result in up to 20 years in prison without parole.