The law is due to lapse in September, something cyber experts and industry officials say would be a huge loss.

From 2009-12, Aleksandr Musienko "partnered with Eastern European computer hackers to obtain over $3 million from U.S. victims’ bank accounts and launder the stolen funds," prosecutors said.

The utility has vowed not to pay a ransom for the attack, which will force the company to rebuild its computer systems.