Dutch Police Arrest 3 Hackers Involved in Massive Data Theft and Extortion Scheme

Feb 27, 2023Ravie Lakshmanan

The Dutch police announced the arrest of three individuals in
connection with a “large-scale” criminal operation involving data
theft, extortion, and money laundering.

The suspects include two 21-year-old men from Zandvoort and
Rotterdam and an 18-year-old man without a permanent residence. The
arrests were made on January 23, 2023.

It’s estimated that the hackers stole personal data belonging to
tens of millions of individuals. This comprised names, addresses,
telephone numbers, dates of birth, bank account numbers, credit
cards, passwords, license plates, social security numbers, and
passport details.

The Politie said its cybercrime team started the investigation
nearly two years ago, in March 2021, after a large Dutch company
suffered a security breach.

The name of the company was not disclosed but some of the firms
that were hit by a cyber attack around that time included RDC^[1], Shell^[2], and Ticketcounter^[3], the last of which was
also a victim of an extortion attempt.

“During the course of the investigation, it has become clear
that thousands of small and large companies and institutions, both
national and international, have fallen victim to computer
intrusion (hacking) in recent years, followed by theft and handling
of data,” the agency said^[4].

The attack spree targeted a wide range of industry verticals
spanning catering, training institutes, e-commerce, software,
social media, and critical infrastructure.

Describing it as a “sophisticated” operation, the Politie said
the threat actors demanded a Bitcoin payment from the affected
companies and threatened to publish the stolen information online
or destroy the digital infrastructure, racking up millions in
damages.

The ransom demanded per company is said to have ranged anywhere
between €100,000 and €700,000. To make matters worse, the suspects
ended up selling the data despite the companies paying up.

The sensitive nature of the plundered information means that it
could be used to carry out social engineering attacks and various
kinds of fraudulent activities.

“Data theft and data trading is a huge revenue model for
criminals,” the Politie warned. “Not just by extorting companies.
The captured data is processed to be traded to other
criminals.”

It further noted how such stolen datasets are being refined and
filtered in a way that makes them easily searchable in order to
find appealing targets and mount convincing attacks.

“Searching and observing on the street is no longer necessary,”
the law enforcement unit said. “A push of a button in front of the
computer is enough.”