Data Security, Government Regulations, Privacy

Rydox data market trading in personal info shut down; feds arrest 3

A stark image of a locked down laptop with police tape across it, symbolizing the quarantine of a system following a severe malware attack

The U.S. government put the clamps on a notorious underground market for stolen personal information.

The Department of Justice said it arrested three people and seized the domain of Rydox, a dark market site that traded in the personal details of thousands of individuals.

“The Rydox marketplace was a one-stop shop where upwards of 18,000 of its cybercriminal customers could choose from more than 300,000 cybercrime tools,” said Eric Olshan, U.S. Attorney for the western district of Pennsylvania where the trials are set to take place.

“While cybercrime often involves conduct occurring overseas and the actions of foreign nationals, its harms can be devastatingly local, with residents in our own communities suffering financial ruin as a result of the theft and misuse of their sensitive personal information.”

As part of the takedown, authorities also arrested three people, two of whom now face extradition and trial in the U.S. Ardit Kutleshi, 26, and Jetmir Kutleshi, 28 were arrested in Kosovo will both be the lucky recipients of an all expense paid trip to the western district of Pennsylvania court where they will face charges of identity theft, conspiracy to commit identity theft, aggravated identity theft, access device fraud, and money laundering.

A third defendant, identified as Shpend Sokoli was arrested in Albania and will face criminal charges there.

Finally, the DOJ said that it has identified and seized the servers hosting the site at a location in Kuala Lumpur, Malaysia.

According to police filings, the money from Rydox was good while it lasted. It is alleged that the site administrators facilitated around 7,600 transactions involving personally identifiable information, card numbers, and account credentials.

From that, the three administrators are alleged to have taken in a haul of $230,000 over the span of roughly eight years. That is not taking into account the trade and sale of other cybercrime and malware packages, of which there were said to be upwards of $320,000.

“The indictment alleges that, for more than eight years, the defendants administered an illicit online marketplace that sold PII, credit card information, and login credentials that had been stolen from thousands of U.S. victims,” said Nicole Argentieri, Principal Deputy Assistant Attorney General for the Justice Department’s criminal division.

“Today, we announce that, working with our domestic and foreign law enforcement partners, we have dismantled the marketplace, arrested its administrators, and seized their criminal proceeds.”

Shaun Nichols

A career IT news journalist, Shaun has spent 17 years covering the industry with a specialty in the cybersecurity field.

You can skip this ad in 5 seconds