Feds Cut Off Access to Billions of Breached Records with Site Takedown

The WeLeakInfo “data breach notification” domain is no more.

The feds and international law enforcement have taken down a website that was selling access to billions of stolen personal records.

The FBI and the Department of Justice said on Thursday that they, in conjunction with the Dutch police, the United Kingdom’s National Crime Agency and Germany’s Bundeskriminalamt, have seized the internet domain name “weleakinfo.com,” effectively suspending its operations. Separately, in conjunction with the case, the Oost-Nederland police arrested a 22-year-old in Arnhem, Netherlands; and, a 22-year-old man in Northern Ireland was also taken into custody, according to local reports.

However, the authorities are still on the hunt for any other suspected operators and owners of the site, and are asking for information as to their whereabouts via the FBI’s Internet Crime Complaint Center (IC3).

WeLeakInfo, despite its name, marketed itself as a legitimate data-breach notification company; it provided subscription services where users could sign up for one-day trial for $2, a week for $7, a month for $25 or three months for $70. Users would gain access to a search engine, used for perusing more than 12 billion personal records gleaned from 10,000 different data breaches. The records contained the usual cybercrime goodies: Names, email addresses, usernames, phone numbers and passwords for online accounts, according to the DoJ. However, it’s self-description on Twitter gives a more altruistic spin on its wares, framing itself as a HaveIBeenPwnd-like service: “Have your passwords been compromised? Find out by searching through over 12 billion records and 10,000 data breaches.”

The site itself seemed blindsided by the action, judging from this tweet:

Site users meanwhile at first didn’t believe the action was real:

And many have taken to the Twitterverse to complain that their subscriptions just started and to request refunds:

“With execution of the warrant, the seized domain name – weleakinfo.com – is now in the custody of the federal government,” according to the FBI’s notice. “Visitors to the site will now find a seizure banner that notifies them that the domain name has been seized by federal authorities.”

Concerned about mobile security? Check out our free Threatpost webinar, Top 8 Best Practices for Mobile App Security, on Jan. 22 at 2 p.m. ET. Poorly secured apps can lead to malware, data breaches and legal/regulatory trouble. Join our experts from Secureworks and White Ops to discuss the secrets of building a secure mobile strategy, one app at a time. Click here to register.

Suggested articles

amazing ring doorbell

FBI: Ring Smart Doorbells Could Sabotage Cops

While privacy advocates have warned against Ring’s partnerships with police, newly unearthed documents reveal FBI concerns about ‘new challenges’ smart doorbell footage could create for cops.

Discussion

  • Eworkflow on

    The site's subscribers should be identified and charged with purchasing stolen data. How hackers can be ever stopped, if their activity generates unpunishable revenue stream from criminal members of the public?
  • Maarten "merethan" on

    Funny how the police likes to appear strong by using kinetic words like "seizure" and "enforcement" in a realm where physical and kinetic concepts really have no meaning at all. It is like the army doing "cyber warfare". The wording and the institution doing it makes no sense at all: One idea can thwart anything that came before it. Doubling the number of soldiers in the division hardly has any impact on effectiveness or might they can project. Sure more brains means more ideas and capacity to crunch numbers, but still one idea can thwart it all. It is nothing like a battlefield or whatever goes down on the city streets. Will they ever learn?

Subscribe to our newsletter, Threatpost Today!

Get the latest breaking news delivered daily to your inbox.