Ukraine’s cyber police have arrested three people suspected of hacking more than 100 million emails and Instagram accounts of users around the world.
The suspects, aged between 20 and 40, are believed to be part of an organized criminal group resident in different parts of the country. If convicted they face up to 15 years in prison.
The accounts, authorities said, were taken over by carrying out brute-force attacks, which use trial-and-error methods to guess login credentials. The group operated under the direction of a leader, who distributed hacking tasks to other members.
The cybercrime group subsequently monetized its illicit credentials by putting them up for sale on dark web forums.
Other threat actors who purchased the information used the compromised accounts to conduct a variety of fraudulent schemes, including ones in which scammers contact the victim’s friends to urgently transfer money to their bank account.
“You can protect your account from this hacking method by setting up two-factor authentication and using strong passwords,” the agency said.
As part of the operation, officials conducted seven searches in Kiev, Odessa, Vinnytsia, Ivano-Frankivsk, Donetsk and Kirovohrad, confiscating 70 computers, 14 phones, bank cards and cash worth more than $3,000.
The development comes as a US citizen pleaded guilty to hacking into more than a dozen entities in the United States, including a medical clinic in Griffin, and exfiltrating the personal information of more than 132,000 people. Sentencing is scheduled for June 18, 2024.
Robert Purbeck (aka Lifelock or Studmaster) “aggravated his crimes by weaponizing sensitive data in an egregious attempt to extort money from his victims,” U.S. Attorney Ryan K. Buchanan said.
According to the U.S. Department of Justice (DoJ), Purbeck, who today pleaded guilty to federal charges of computer fraud and abuse, purchased access to the clinic’s server from the darknet in 2017, exploiting it to steal medical records and other documents that contained data on more than 43,000 people, such as names, addresses, dates of birth and Social Security numbers.
The defendant also purchased credentials associated with the City of Newnan, Georgia, Police Department server on an underground market. He then ransacked archives consisting of police reports and documents containing information belonging to no fewer than 14,000 people.
As part of the plea deal, Purbeck agreed to pay more than $1 million in restitution to the 19 affected victims. He was indicted by a federal grand jury in March 2021.