Ukrainian cyber police have arrested three people suspected of hijacking more than 100 million emails and Instagram accounts from users around the world.
The suspects are said to be aged between 20 and 40 years old and are members of organized crime groups living in different parts of the country. If convicted, they face up to 15 years in prison.
Authorities said the accounts were taken over through a brute-force attack that used a trial-and-error method to guess login credentials. The group operates under the direction of a leader, who assigns hacking tasks to other members.
The cybercrime group then monetized its illegally obtained credentials by selling them on dark web forums.
Other threat actors who purchase this information use compromised accounts to conduct various fraud schemes, including scammers contacting victims’ friends to urgently transfer money to their bank accounts.
“You can protect your account from this hack by setting up two-factor authentication and using a strong password,” the agency said.
As part of the operation, officials conducted seven searches in Kiev, Odessa, Vinnytsia, Ivano-Frankivsk, Donetsk and Kirovolad, confiscating 70 computers, 14 cell phones, bank cards and more than $3,000 worth of cash.
The development comes as a U.S. national admitted to hacking more than a dozen entities in the United States, including a medical clinic in Griffin, and exfiltrating the personal information of more than 132,000 people. He is scheduled to be sentenced on June 18, 2024.
U.S. Attorney Ryan K. Buchanan said Robert Purbeck, also known as Lifelock or Studmaster, “escalated his crimes by weaponizing sensitive data to blackmail his victims.”
According to the U.S. Department of Justice (DoJ), Purbeck pleaded guilty today to federal computer fraud and abuse charges in 2017 when he purchased access to a clinic’s computer server from the dark web and used it to steal medical records and other information including: File: Data involving more than 43,000 individuals, such as names, addresses, dates of birth and Social Security numbers.
The defendants also purchased credentials on the underground market related to a server for the Newnan, Georgia, police department. He then looted records consisting of police reports and documents containing information on at least 14,000 people.
As part of the plea agreement, Purbeck agreed to pay more than $1 million in restitution to the 19 affected victims. In March 2021, he was indicted by a federal jury.
