According to the authorities who conducted the investigation, the 24-year-old used a former darknet and clearnet cybercrime forum called Crime Network. Evidence revealed that the suspect actively sold Paypal logins and credit card datasets. He allegedly obtained the information through phishing campaigns controlled through a dedicated server. Authorities believe the emails used in the phishing campaigns came from several attacks on various internet shops and sites with registration requirements. He operated in this fashion between August 2013 and May 2015, the press release revealed.
Both the clearnet and darknet versions of the Crime Network forums vanished in late 2015. The authorities may have obtained the information through the archived versions of the forum. After the Crime Network forums vanished, the hacker turned to other fraud forums to sell his stolen data. The release did not reveal what sites he used after the Crime Network—it is possible the sites are still active whereas the Crime Network is not.
The investigation began in mid-2016. A hacker attacked the website of a large online retailer and accessed the information of nearly 500,000 customers. The retailer filed a complaint almost immediately and investigators discovered the method used to comprise the site’s security: SQL injection. Authorities in Ingolstadt worked closely with the Central Office of Cybercrime to catch the hacker. Their investigation eventually led to a man living in Cologne. According to the press release, the hacker had been selling the stolen customer information on various internet platforms for some time (presumably since he hacked the retailer’s site in question).
The Attorney General in Bamberg secured search warrants for the 24-year-old’s apartment in Cologne. The Ingolstadt Criminal Police, alongside other law enforcement North Rhine-Westphalia, raided the apartment in February 2017. Officers arrested the suspected hacker without issue. Authorities reportedly seized several computers, phones, and storage devices as evidence. An analysis of the seized electronic devices revealed evidence that could bring additional charges. The press release did not go into detail regarding the contents of the storage devices.
A judge ruled that the 24-year-old was too likely to flee if granted bail. On account of his ‘high flight risk’ status, the suspected hacker has been in custody since his arrest.