Three Dutch men have been arrested on suspicion of participating in a massive cyber extortion campaign affecting tens of millions of victims.
According to Dutch police, the main suspects are a 21-year-old from Zandvoort, a 21-year-old from Rotterdam and an 18-year-old with no fixed address.
An investigation into the suspicious activity began in March 2021 and uncovered evidence of attacks against thousands of domestic and international organizations.
After gaining initial access to the targeted companies and stealing sensitive customer information, the men either destroyed their “digital infrastructure” or made the information public, in a manner similar to ransomware actors. He allegedly coerced the victim by threatening to divulge it.
However, Dutch police claimed that “often” the hackers sold the stolen data even after receiving the ransom.
Ransom demands ranged from €100,000 to €700,000 ($106,000 to $740,000), with reports claiming that the main suspect earned as much as €2.5 million ($2.6 million) over the past few years.
The stolen data included names, addresses, phone numbers, dates of birth, bank account numbers, credit card details, passwords, license plate numbers, national ID numbers, and passport data. , the police claim.
These attacks have caused financial and reputational damage to compromised businesses, and pain to individuals whose information has been stolen and sold in the cybercrime underground.
Hospitality companies, training institutions, online stores, software companies and even social media providers were among the compromised businesses, police said.
Data obtained from compromised companies is increasingly processed prior to sale to add even more value to cybercriminals who seek to use it for subsequent phishing and fraud.
“Investigations revealed that special computer code was used to improve the stolen data,” the police report revealed.
“Stolen databases are particularly well suited for data refinement to approach specific victims, such as phishing, chat tricks, bank help desk fraud, and identity fraud. You can filter the database by Dutch born.”
