On Tuesday, July 20, a 28-year-old man from Purmerend had to account for himself before the court because he is suspected of attempted blackmail and computer intrusion.
The suspect worked at a company and secretly collected personal data that he had access to through his job. When he no longer worked there, he attempted to blackmail the company a few years later with the collection of personal data. If the company did not comply, he would disclose the personal data he had acquired.
The public prosecutor indicated at the start of the indictment how serious this is: The impact of a data breach is not only significant for the individuals whose data has been obtained but also for the companies involved. A data breach can have significant financial consequences for companies and lead to reputational damage.
Threatening email
On April 26, 2023, the man sent a threatening email to the company in which he stated that the organization had become a victim of a data breach. As proof, he attached a portion of the customer data to the email. A manager of the company responded to the email, and ultimately, on May 1, the suspect requested €50,000 in bitcoins. If the amount was not transferred by May 4, a report would be made of the data breach to the victims, the media, and the companys partners. This message would also state how irresponsible the company had acted and how poorly their system was secured, while the company was aware of this. He also threatened to sell the victims personal data on the Dark Web. The consequences of all this would cost the company more than the amount the man requested, so it would be better to pay up.
Evidence
The 28-year-old man eventually confessed to the blackmail. Evidence was also found on his phone that shows he is the perpetrator. Examples of the personal data he emailed were found on his mobile.
In addition to the attempted blackmail, he is also suspected of computer intrusion from January 21, 2021, to November 15, 2021. The suspect admits this as well: instead of a data breach, he copied customer data and sent it to himself.
Scope
The public prosecutor clarified the scope during the hearing: 663 email addresses of victims were found on the suspects laptop. His phone contained the data of 39,307 people. The suspect categorized the files by age and gender and, in many cases, also linked them to a specific bank. He clearly invested a lot of time in this, which according to the public prosecutor indicates targeted action.
It appears that the suspect deliberately made searches in the system because the victims from whom the data was collected were often 48 years or older. An age group that often falls victim to online crime. For example, people aged 65 and older are most often victims of phishing. Many files contained the word sold; the suspect did not want to indicate what this meant. Files were also found with the names: Rabo 65 + 500 SOLD and Old but no 06.
The public prosecutor also pointed to the agreements the suspect had signed as an employee. He was required to handle the data confidentially and was only allowed to make searches in the system to assist customers; he was not allowed to take data for personal use.
Impact enormous for victims
The public prosecutor emphasized the seriousness of the facts during the hearing. He collected personal data for an extended period and blackmailed a company with it. For the company and the people whose data has fallen into the wrong hands, the impact is enormous. The man acted very deliberately. He copied personal data from nearly 40,000 people and sent it to himself. He never had a change of heart. He collected data for months, and years passed before he committed the blackmail.
He admits to the facts he cannot deny. He does not seem to provide real transparency.
All in all, the public prosecutor demands a sentence of 8 months in prison, of which 3 months are conditional with deduction and a two-year probation period with special conditions.
Additionally, the two mobile phones and the laptop of the suspect should be confiscated according to the public prosecutor.
