Amsterdam’s cyber crime police team has arrested three young men as part of a major investigation into hacking, data theft, blackmail and money laundering involving the private details of tens of millions of people. 

The three, aged 21 and 18, were picked up on January 23 and two have been restricted to contact with their lawyers only, in the interests of the investigation, police said. 

One of the three is a ‘very clever hacker who has come on the police radar before,’ a justice department spokesman told the Telegraaf. ‘Data is the new gold and these are the new bank robbers.’ 

According to broadcaster NOS, one of the team also worked for the data security organisation DIVD or Dutch Institute for Vulnerability Disclosure, which the government is considering giving a greater role in tackling cyber crime. He did have access to ‘sensitive information’, the source said.

Probe

The investigation started in March 2021 after a ‘large Dutch company’ reported that its systems had been hacked and a large quantity of data stolen. ‘It has since become clear that thousands of small and larger companies, both national and international, have been the victim of hacking and data theft,’ the police said in a statement.

This means privacy-sensitive information – including names, addresses, credit card details, dates of birth and BSN numbers – from tens of millions of people has ended up in the hands of criminals, police said.

According to RTL Nieuws, one of the companies hit by the hack is Ticketcounter, which sells tickets online for amusement parks and zoos. The Telegraaf says a major educational institution and meal delivery service are also among the victims. 

Bitcoin

Once the hackers have accessed the systems of their target companies, they send a threatening email demanding payment in bitcoin. If they don’t pay, the hackers say they will destroy the company’s digital infrastructure or publish the stolen information.

Many companies have paid up. ‘According to what we know so far, the demand ranges from more than €100,000 to €700,000 and, in addition, the stolen information has often already been sold online.’

Police estimate the main suspects have had a ‘criminal income’ of €2.5 million.

The January arrests follow the arrest of a 25-year-old man from Almere in November. He was found to have databases in his possession which police were aware of following reports of data hacks, a police source told RTL. 

The four knew each other from online forums and chat service Telegram, where they exchanged tips and offered each other services, the police source said.