Polish and Swiss law enforcement authorities, supported by Europol and Eurojust, have discovered a hacking group that accessed more than EUR 600k in loyalty points and sold them on to another criminal group.
On 29 April 2020, the Polish National Police (Policja) searched six locations in five Polish regions and arrested five individuals believed to be members of the hacking group InfinityBlack. Police seized electronic equipment, external hard drives and hardware cryptocurrency wallets, all worth around EUR 100 000. Two platforms with databases containing over 170 million entries were closed down by the police.
Hackers target loyalty point scheme for high-end electronics. The hacking group created online platforms to sell user login credentials known as ‘combos’. The group was efficiently organised into three defined teams. Developers created tools to test the quality of the stolen databases, while testers analysed the suitability of authorisation data. Project managers then distributed subscriptions against cryptocurrency payments.
The hacking group’s main source of revenue came from stealing loyalty scheme login credentials and selling them on to other, less technical criminal gangs. These gangs would then exchange the loyalty points for expensive electronic devices.
The hackers created a sophisticated script to gain access to a large number of Swiss customer accounts. Although the losses are estimated at EUR 50 000, hackers had access to accounts with potential losses of more than EUR 610 000.
Once the criminal gang cashing out the loyalty points was identified in Switzerland, police exchanged criminal intelligence and uncovered links to members of the separate hacking group in Poland. Transmitting the data on searched computers between the Swiss and Polish authorities led to the arrest of the hackers in Poland.
Every day we send out a free e-mail with the most important headlines of the last 24 hours.
Subscribe now