The court also ordered the men to pay a fine. The 20-year-old chief hacker was given a €9,000 ($15,246) fine, while his 28-year-old collaborator was ordered to pay €4,000 ($6,733).
The fraudsters infected millions of PCs with a Trojan horse called Toxbot and hijacked the compromised machines to steal credit card details and other personal information, court reports said.
They also used the infected computers to launch denial-of-service attacks against websites.
The duo, who were arrested in October last year, used the stolen data to buy electronic goods, including iPods, digital cameras and PlayStation game consoles.
One of the men was responsible for creating the Trojan horse, while his accomplice helped spread the malware and maintain the botnet network.
Several other suspects in the case are still awaiting sentencing.