Cyber ring in Ukraine caught stealing 100m email, Instagram accounts

Cyber police in Ukraine have busted a criminal group that used brute force attacks to steal 100 million email and Instagram accounts.

Three individuals have been charged with the theft of millions of email and Instagram accounts, facing up to 15 years in prison if convicted, Ukraine's cyber police said.

The group was identified by the cyber police force of the Kharkiv region, eastern Ukraine, in cooperation with the Main Directorate of the National Police and the Kharkiv Regional Prosecutor’s Office.

The suspects used the brute force method to hack the accounts, employing specialized software to guess passwords from numerous combinations, police reported. Two-factor authentication could prevent such attacks, it said.

Aged 20 to 40, the suspects lived in different parts of Ukraine and communicated with each other via the internet. The organizer of the group assigned tasks to others, who then formed databases of hacked accounts and offered them for sale on the darknet.

Initial findings reveal that the group possessed databases of over 100 million stolen accounts from internet users worldwide. Police say the hacked accounts were mainly sold to other criminal groups for use in various fraud schemes.

As part of the operation, law enforcement carried out raids across seven locations in Kyiv, Odesa, Vinnytsia, Ivano-Frankivsk, as well as Donetsk and Kirovograd regions. The police seized more than 70 units of computer equipment, 14 phones, bank cards, and cash, including more than $3,000.

The investigation continues, with police also looking into the suspects’ links to Russia. The authorities said that some of the stolen accounts were used for conducting psychological and information campaigns in the interests of the Russian Federation.