Sydney man charged over Netflix, Spotify credential-stuffing, stolen accounts

A Sydney man has been charged by the Australian Federal Police for allegedly selling stolen subscription credentials for online streaming services including Netflix and Spotify.

The 21-year-old was arrested during a raid of a Dee Why property in Sydney’s northern beaches yesterday that also seized cryptocurrencies and electronic materials.

The arrest follows a joint international cybercrime investigation with the US Federal Bureau of Investigations into an account generator website called WickedGen.com.

The website sold stolen account details for online subscription services, including Netflix, Spotify and Hulu, for around two years before being shut.

The AFP said the “account details were obtained through credential shuffling, which sees a list of previously stolen or leaked usernames, email addresses and corresponding passwords re-use and sold for unauthorised access”.

 “Prior to WickedGen’s closure, the website advertised it had over 120,000 users and almost one million sets of account details,” the AFP said, adding that unknowing customers were located in Australia and abroad, including the US.

“Police will allege the administrator of WickedGen made an estimated AUD $300,000 selling the stolen account subscriptions through this website, and other similar sites identified through the course of investigations.”

Cyber crime manager, acting commander Chris Goldsmid said international relationships had been key to the investigation and subsequent arrest.

“This arrest is another example of the value and importance of our relationship with the FBI. These partnerships – both internationally and domestically – are critical in law enforcement being able to respond to rapidly-evolving and increasingly global crime types.”

“Individuals in Australia have had their personal data stolen for the sake of individual greed. These types of offences can often be a precursor to more insidious forms of data theft and manipulation, which can have greater consequences for the victims involved.

“We are working closely with the affected companies and thank them for their cooperation with investigations to date.”

The 21-year-old man will appear before Sydney Central Local Court today charged with of offences relating to the alleged use of false identifies and cybercrime.