Cybercrime , Fraud Management & Cybercrime , Fraud Risk Management

Police Allege Hacker Sold Millions of Email Credentials

Security Service of Ukraine Arrests 'Sanix' for Serving as Broker on Darknet
Police Allege Hacker Sold Millions of Email Credentials
Ukrainian and U.S. currency, cell phones and computer equipment seized during the arrest of "Sanix" this week (Photo: Security Service of Ukraine)

The Security Service of Ukraine this week arrested a hacker known as "Sanix" who allegedly sold combinations of millions of email usernames and passwords on darknet forums.

See Also: OnDemand | Combatting Rogue URL Tricks: How You Can Quickly Identify and Investigate the Latest Phishing Attacks

Police say that on Tuesday, they arrested Sanix in Ivano-Frankivsk, a city in western part of Ukraine. The hacker's real name was not released.

Ukrainian law enforcement officials allege that Sanix had been acting as a data broker who would assemble millions of combinations of usernames and passwords taken during various data breaches around the world, and then package those up for sale on darknet forums. The hacker allegedly was selling over 773 million e-mail address usernames and 21 million unique passwords, according to the Security Service of Ukraine

Investigators allege that Sanix also sold databases that included PIN codes for bank cards, e-wallets for cryptocurrencies, compromised PayPal accounts as well as information about hacked computers for use in botnets and distributed denial-of-service attacks.

During a search of Sanix's residence this week, Ukrainian police confiscated computer equipment containing with nearly 2 TB of stolen data, cell phones and about $3,000 in U.S. currency along with another $7,000 in Ukrainian currency.

When he's arraigned, Sanix is likely to be charged with "unauthorized interference with computers and unauthorized sale or dissemination of information with limited access stored in computers," under the Ukrainian criminal code, according to the Security Service of Ukraine.

'Collection #1'

Security researchers have long suspected that a hacker named Sanix was responsible for assembling and then selling combinations of usernames and passwords that were part of a massive data dump called "Collection #1."

In January 2019, Australian information security expert Troy Hunt, who runs the HaveIBeenPwned breach notification service, brought to light a massive collection of breached data that contained about 2.7 billion rows of email IDs and password combinations, equalling about 87 GB of data. This combination of email credentials was eventually called Collection #1 (see: Data Breach Collection Contains 773 Million Unique Emails).

Databases confiscated this week from Sanix in Ukraine contained traces of stolen data connected to Collection #1, authorities say.

Investigators examine computer belonging to Sanix. (Photo: Security Service of Ukraine)

Much of the data contained in Collection #1 was old, but it was still valuable to fraudsters who could use the credentials in brute-force attacks and other schemes, researchers say.

Sanix is not believed to have been involved in the actual theft of the data; he only acted as a broker, collecting the data and assembling it for sale, Alex Holden, CTO and founder of the security firm Hold Security, told security blogger Brian Krebs.

A January 2019 report from security firm IntSights reported that a hacker named Sanix was involved in assembling and selling data related to the Collection #1 breach. The report noted that the stolen data started circulating in November 2018 and was first assembled and put up for sale the following month.

Earlier this month, analysts with cybersecurity firm Intel 471 observed that Sanix also was allegedly involved in other cybercrime activities, including selling access to dozens of universities around the world as well as a VPN account for the government of San Bernardino County in California, according to Krebs.


About the Author

Ishita Chigilli Palli

Ishita Chigilli Palli

Senior Correspondent, Global News Desk

As senior correspondent for Information Security Media Group's global news desk, Ishita covers news worldwide. She previously worked at Thomson Reuters, where she specialized in reporting breaking news stories on a variety of topics.




Around the Network

Our website uses cookies. Cookies enable us to provide the best experience possible and help us understand how visitors use our website. By browsing bankinfosecurity.in, you agree to our use of cookies.