Police in the United Kingdom have arrested seven people over suspected connections to the Lapsus$ hacking group, which has in recent weeks targeted tech giants including Samsung, Nvidia, Microsoft and Okta.
In a statement given to TechCrunch, Detective Inspector Michael O’Sullivan from the City of London Police said: “The City of London Police has been conducting an investigation with its partners into members of a hacking group. Seven people between the ages of 16 and 21 have been arrested in connection with this investigation and have all been released under investigation. Our enquiries remain ongoing.”
News of the arrests comes just hours after a Bloomberg report revealed a teenager based in Oxford, U.K. is suspected of being the mastermind of the now-prolific Lapsus$ hacking group. Four researchers investigating the gang’s recent hacks said they believed the 16-year-old, who uses the online moniker “White” or Breachbase,” was a leading figure in Lapsus$, and Bloomberg was able to track down the suspected hacker after his personal information was leaked online by rival hackers.
According to security reporter Brian Krebs, the teenager purchased Doxbin last year, a site where people can share or find personal information on others, before giving up control of the website in January and leaking the entire Doxbin data set to Telegram. The Doxbin community retaliated by releasing personal information on him, including his home address, social media photos, and details about his parents.
TechCrunch has seen a copy of the the suspected hacker’s leaked personal information, which we are not sharing, but matches Bloomberg’s reporting.
City of London Police, which primarily focuses on financial crimes, did not say if the 16-year-old was among those arrested.
At least one member of Lapsus$ was also apparently involved with a recent data breach at Electronic Arts, according to Krebs, and another is suspected to be a teenager residing in Brazil. The latter is said to be so capable of hacking that researchers first believed that the activity they were witnessing was automated.
Researchers’ ability to track the suspected Lapsus$ members may be because the group, which now has more than 45,000 subscribers to its Telegram channel where it frequently recruits insiders and leaks victims’ data, does little to cover its tracks. In a blog post this week, Microsoft said the group uses brazen tactics to gain initial access to a target organization, which has included publicly recruiting company insiders. As reported by Bloomberg this week, the group has even gone as far as to join the Zoom calls of companies they’ve breached to they have taunted employees trying to clean up their hack.
The Lapsus$ hacking group first came to light in December 2021, when it mainly focused on targeting organizations in the U.K. and South Africa. Earlier this week, its latest victim was confirmed as Otka, which on Wednesday admitted that around 366 corporate customers were affected by the breach.
