A 35-year-old man from Leeuwarden, the Netherlands, used personal information he stole from his customers to open gambling accounts, as well as convincing friends and relatives of the victims to transfer money and make online purchases on his behalf.
The man established himself as a legitimate webmaster building e-commerce websites to customers. But apparently, he created backdoor on the sites he created by installing custom scripts in order to steal customer logins.
With those credentials, he was able to break into emails and social media accounts of his victims.
Out of the 140 websites the malicious web developer created, he was able to retrieve 20,000 login credentials over the course of several years. The police alerted website administrators of the websites he created to search for the backdoor script he employed.
In addition, they're also encouraging victims to check their accounts and change their email passwords.
The police first found the web developer's malicious attempt when a user complained about finding purchases someone else made on his behalf. Initially, the police thought that they were dealing with a cyber-fraud investigation. But after two years gathering data and expanding the investigation's scope with additional digital forensics experts in 2016, the police realized the extend of the criminal's operation.
Police said that it's impossible to determine the full breadth of his hacking, but evidence was found on his seized laptop. The police gained access to a cache of credentials, which was later used as evidence of his fraud and identity theft.
Victims include both single individuals and businesses. The suspect is under investigation in over 140 cases already.
The criminal web developer was arrested at a hotel in Zwolle, the Netherlands. The police proceeded to raid two houses he owned in Leeuwarden and Sneek.
After his arrest, scammers appeared to have their own plan in tricking those victims. They've sent emails to them that appeared to be sent by the police with links in the body. Netherlands police noted the emails they are sending this week contain no links as there's nothing to download.
