A Dutch website builder leveraged a secret script to steal 20,000 users' login credentials, hack their accounts, and commit payment fraud. On 17 January, police in the northern Netherlands announced they're contacting 20,000 users with the advice that they change their passwords as soon as possible. This move comes several months after the world first learned of an investigation launched by Dutch authorities into a computer crime operation. The investigation began back in November 2014 when a user complained that someone had made purchases on their behalf. A single suspect quickly came into focus, as did some of their additional criminal activities. Two years later, law enforcement decided to expand the case's research team so that they could take the criminal down.
Source: politie.nl Investigators learned that their suspect, who is 35 years old, had been hiring himself out to companies as an e-commerce site builder. Whenever he completed a project, he installed a secret script into the site that helped him phish for visitors' usernames and passwords. He then used these credentials to hack into his victims' email accounts and social media profiles, unauthorized access which he abused to commit various forms of payment fraud. In one instance, the devious developer used someone's Facebook account to contact their friends and trick them into paying his bills. In other scenarios, he used his victims' credentials to make fraudulent purchases in web stores and on gambling websites. Authorities ultimately arrested the individual on 11 July 2016 at a hotel in Zwolle. They also searched his homes in Leeuwarden and Sneek, from which they confiscated several data storage devices and computers. The man's pre-trial proceedings began on 18 October 2016. As of this writing, more than 140 cases are included in the suspect's file. Payment fraud was among the top eight computer crime trends identified by Europol in 2016. No doubt it will continue to make an impact in 2017. With that in mind, organizations should strengthen their security postures against computer criminals with the help of key endpoint configurations, breach detection rules, employee awareness training, and other measures.
