The Amsterdam Prosecutor’s Office disclosed that a 25-year-old Dutch man was arrested in late November on suspicion of stealing personal data from tens of millions of people worldwide, including most of Austria’s population.
The data was allegedly offered for sale. The cybercriminal landed on the radar of Austrian police during the investigation of a dataset offered on a hacker forum. The dataset contained millions of personal datapoints originating from an Austrian government organization.
Austrian police managed to purchase the dataset through an undercover operation. The force subsequently launched an investigation into the financial flows and the platform used to transmit the data. This led to the discovery of an IP address from Amsterdam.
In April 2022, the Austrian Prosecutor’s Office requested that the Amsterdam Prosecutor’s Office take over the case. A local Dutch cybercrime unit further investigated the data and a suspect identified on the hacker forum. Meanwhile, the Amsterdam Prosecutor’s Office has announced that the suspect was arrested in late November.
The prosecutor alleges the suspect offered an enormous database of private personal information for sale, including patient data from medical records. In addition to Austrian citizens, residents from the Netherlands, Thailand, Colombia, China and the United Kingdom are said to be affected.
Several offences are at play: having or making private data available, using hacking tools and laundering money. The latter relates to the cryptocurrency for which some of the data was allegedly sold. The sale is said to have been worth €450.000 in cryptocurrency in 2022.
The suspect’s preliminary arrest was extended by 90 days on December 5. The prosecution is currently working on financial and digital follow-up investigations.