A suspect in a case involving hacking, blackmailing and Bitcoin has been arrested in Hong Kong. A 30-year-old computer technician has been taken in custody in connection with cyberattacks against two travel agencies. The man risks years of imprisonment. Personal data of customers was held for ransom. Tour operators were asked to pay 1 Bitcoin for its release.
Send the Bitcoin if You Want It Back
Names, identity card numbers, passport details and phone numbers of 20,000 clients were part of the sensitive information. The companies, Big Line Holiday and Goldjoy Holidays, reported the hacking of their computers on January 1 and 2. They told police they had received emails from the unknown culprit who demanded 1 Bitcoin (about $15,000) to be paid as ransom.
Officers from Hong Kong’s Cyber Security and Technology Crime Bureau (CSTCB) raided an apartment on Cheung Chau Island and arrested the man, South China Morning Post reported. During the operation, police seized two desktop computers, two laptops, a tablet, three hard disks and five mobile phones. They also escorted the suspect to his workplace in Kowloon on Monday to gather more evidence. He has been described by local media as an “IT worker”, a “computer technician”. The man was handcuffed on Saturday night, January 6, at his home in Cheung Chau, The Standard reported.
The agencies were hacked on New Year’s Day when the attacker supposedly took advantage of weakened security of their websites. The companies received an email shortly after and were told to send the Bitcoin to a newly opened address. The author of the blackmail letter threatened that if they failed to pay the ransom the personal data of their customers would be posted on the internet Saturday, a police source told SCMP. After checking thousands of logs on the servers, the Cyber Security Bureau agents managed to identify the attacker’s IP address and trace it back to the suspect.
Hong Kong Hacker Arrested in Blackmail for Bitcoin Case
No Bitcoin, No Ransom, No Problem
No sensitive information has been lost, as it was actually locked, not stolen. Police moved to apprehend the hacker hours before the ransom deadline. No charges have been levied against the suspect yet, as investigators are still questioning him and gathering information from forensic examination of hardware and software. Law enforcement officials have not ruled out further arrests as part of the ongoing investigation. The CSTCB superintendent Swalikh Mohammed described blackmail as a serious offence, punishable by up to 14 years in prison. He also warned:
The cyber world is not a lawless place. Laws applicable to the real world can also be applied to the internet
Both travel agencies have since apologized to their customers for the hacking incidents and pledged measures to improve cybersecurity. A Goldjoy representative said the company was pleased that a suspect had been apprehended so quickly. He insisted that it was highly unlikely its data storage would be hacked again after the new security upgrades. Big Line announced that it had taken immediate countermeasures after the breach. Almost $1.3 million of funding for cybersecurity improvements is available for small to medium sized businesses in the travel industry, government officials reminded.
Hong Kong’s privacy watchdog expressed concerns about the incident involving the possible theft of sensitive information. “Travel agents, as data users, should take all reasonable security measures to protect customers’ personal data,” Privacy Commissioner Stephen Wong Kai-yi said, noting a “rising trend”.
Hong Kong Hacker Arrested in Blackmail for Bitcoin CaseThe latest incidents are really a second episode in the “Blackmail for Bitcoin” series. Back in November, one of the largest tour operators in the city – Worldwide Package Travel Service, announced its customer database had been hacked. Personal information, including credit card numbers, of some 200,000 people had been locked by the hackers. WWPKG was asked by the unknown blackmailers to pay a seven-figure ransom, again in Bitcoin. The company called the police and their experts managed to decrypt the data but no arrests were made.
No loss of financial information has been reported in either of these cases. According to data quoted by the local press, Hong Kong’s Cyber Security Bureau has recorded close to 6,000 cases of cybercrimes in 2016 alone. Financial losses, since the agency was established in 2005, have been estimated at almost $295 million.