Roman Seleznev, 32, was found guilty by a federal jury in Seattle on 38 of 40 counts, including intentional damage to a protected computer and wire fraud.
Prosecutors said he was a "master hacker" behind a plan which led to $170m (£131m) of fraudulent purchases.
Vowing to appeal, his lawyer argued he had been kidnapped by US agents.
Seleznev (his name is also spelt Seleznyov in English) faces a mandatory minimum sentence of four years in jail, lawyer John Henry Browne said. A sentence is expected on 2 December.
The Russian also faces similar charges in federal courts in Nevada and Georgia.
Prosecutors say Seleznev hacked into retail systems and installed malware to steal credit card numbers from businesses, mostly pizza restaurants in the state of Washington.
He then sold the information online, they say. The scheme is said to have been carried out between 2008 and 2014.
Roman is the son of Valery Seleznev, a Russian member of parliament for the Liberal Democratic Party.
He and his girlfriend were arrested by US Secret Service agents at a Maldives airport in July 2014.
Lawyers argued that his arrest was a "kidnapping" or an "illegal rendition" that violated international law but a US district judge blocked that argument from the trial.
Mr Browne said they planned to challenge his client's arrest and a ruling that allowed prosecutors to introduce evidence from a corrupted laptop seized with him.
The computer contained more than 1.7m stolen numbers, along with evidence linking him to various servers, prosecutors said.
The son of a Russian MP has been convicted on charges that he orchestrated a hacking scheme that targeted US pizza restaurants.