The Royal Canadian Mounted Police announced on Jan. 15 that they have arrested and charged the operator of the LeakedSource.com website with selling stolen online user identities.
Charged is 27-year old Jordan Bloom of Thornhill, Ontario, on allegations that he was trafficking in identity information and was in possession of property obtained by crime. LeakedSource.com sold usernames and passwords that were allegedly obtained via multiple large data breaches that have occurred in recent years. The LeakedSource.com website has been taken offline.
“This investigation is related to claims about a website operator alleged to have made hundreds of thousands of dollars selling personal information,” Inspector Rafael Alvarado, officer in charge of the RCMP Cybercrime Investigative Team at National Division, stated. “The RCMP will continue to work diligently with our domestic and international law enforcement partners to prosecute online criminality.”
The arrest and charges against Bloom were part of an RCMP operation dubbed “Project Adoration,” which began in 2016. Through the RCMP investigation and in collaboration with the FBI and the Dutch National Police, it was discovered that the LeakedSource.com site was hosted by servers located in the province of Quebec.
The RCMP investigation found that LeakedSource.com had a database that included approximately 3 billion usernames and passwords, with Bloom selling access to those passwords for what the RCMP referred to as a small fee. Bloom earned approximately $247,000 CDN ($198,800 USD) from selling the username and password information.
The data being sold on LeakedSource.com was not the result of any new data breaches, but rather was an aggregated collection of data breached in the last few years. In a press conference, RCMP Staff Sgt. Maurizio Rosa said the data came from well-known public breaches, including LinkedIn and Ashley Madison.
The LinkedIn data breach was first reported in 2012 as only impacting 6.5 million users. In 2016, LinkedIn revised its impact estimate upward to 100 million users. The attacker behind the LinkedIn data breach was apprehended by law enforcement in the Czech Republic in October 2016 and has been indicted by the U.S. Department of Justice.
The Ashley Madison website was breached in July 2015, exposing usernames and passwords of 37 million users. A hacker group that identified itself as “The Impact Team” took credit for the Ashley Madison breach.
In the immediate aftermath of the LinkedIn breach, LinkedIn took steps to reset user passwords to mitigate risk. The risk of breached passwords, however, extends beyond any one single site or service.
The RCMP warned that the danger that LeakedSource.com highlights is reusing passwords across multiple sites across the internet. The risk is that if a website is breached leaking usernames and passwords, that information can then be used to enable attackers to access accounts on other sites where the users have reused the same password.
Sean Michael Kerner is a senior editor at eWEEK and InternetNews.com. Follow him on Twitter @TechJournalist.