AMSTERDAM (AFP): Dutch police said Thursday they have arrested three young men suspected of stealing tens of millions of sensitive personal data and selling it to criminal gangs.
Two men aged 21 and another 18 years old, were arrested last month, after an in-depth investigation that started in 2021, police said in a statement.
The probe was sparked after a large Dutch company laid a charge of data theft and blackmail.
“As the investigation progressed, it became clear that thousands of small and large businesses and institutions, nationally and internationally, were targeted by the hacking, theft and selling of data,” police said.
The suspects’ methods were “refined”, they added, hacking a company’s computer systems before sending a threatening mail demanding ransom in bitcoins.
“If the company did not pay, the suspects threatened to wreck its digital infrastructure or make publish sensitive data.”
Many companies paid the ransom, often more than 100,000 euros ($105,000) and 700,000 euros in one particular case.
“In many cases, the stolen data was sold anyway, even though the companies paid,” earning the main suspect an income of 2.5 million euros over the past few years.
Diverse companies fell victim including those in the hospitality industry, training centres, webshops and those “belonging to the vital infrastructure”, police said.
“The data included dates of birth, bank account numbers, credit card numbers, passwords, car licence registrations, and ID and passport numbers,” police said.
“This information is worth its weight in gold to criminals,” police said, adding “the impact for those who fell victim is enormous”.
This was not only for the companies who were blackmailed but also for those targeted by the information sold to criminal gangs.
“It’s no longer necessary to look for victims on the streets. One press of a button behind a computer suffices” is enough, police said.
The suspects will remain in jail — two under maximum security, meaning they are only allowed contact with their lawyers — while the investigation continues, police said.
The arrests followed a similar case last year when an Amsterdam man was taken into custody for selling the online data of tens of millions of people online.
That arrest followed a probe by Austrian police after a dataset containing millions of names gleaned from the Austrian television and radio licence provider appeared on a cybercrime forum.
Austrian police bought the dataset in an undercover operation and police traced the online address to a home in Amsterdam.
