French police have shut down two websites accused of selling stolen personal data by subscription and arrested three 17-year-olds suspected of running them, Reuters reported Friday. The service claimed to hold 730 million lines of data, including bank account numbers, the kind of pooled records that fraudsters use against bank customers and the finance staff of ordinary companies.

What Happened

France's anti-cybercrime unit took down the sites, and Paris prosecutor Laure Beccuau announced the action in a statement Friday, according to Reuters. The three suspects are male; they have not been named, and The Primary Wire does not identify minors accused of crimes.

The platform launched in March under the name Reacher and sold personal data gathered from various sources to the public through several subscription tiers, Reuters reported. It was renamed Stryx in June. The service claimed to hold 730 million lines of data, including names, addresses and bank account numbers, and said it had received 3.1 million requests.

RelatedDealership IT Vendor Reports Attack Surge, Says MFA Was in Place When Logins Were Stolen

If convicted, the three could face up to 10 years in prison. The Reuters report did not detail the specific charges or say where the data had come from.

Why It Matters

The business model is the notable part. Instead of trading a single leaked database on a criminal forum, the operators allegedly packaged data from many sources into a paid service with tiered plans, open to the public. The claimed 3.1 million requests over roughly seven months, from the March launch to the October takedown, suggest steady demand from paying users.

The 730 million figure should be read with care. It is the service's own claim, reported by Reuters, and has not been independently verified. A "line" is generally one record in a data file, and compiled leak data tends to repeat the same people many times, so the number does not show how many individuals were exposed.

For organizations, the takedown removes a storefront, not the data. Anyone who queried the service may still hold what they downloaded. The combination Reuters described, names and home addresses alongside bank account numbers, is the raw material for calls in which fraudsters pose as a customer's bank, and for requests to finance teams to change a supplier's or employee's payment details. Companies with large French customer or staff bases can reasonably assume some of that data remains in circulation and keep confirming bank-detail changes through a separate, known channel.

The Age of the Suspects

Because the suspects are 17 now, they were 16 or 17 when Reacher launched in March. That an alleged subscription business of this scale could be run by teenagers is a measure of how widely leaked data now circulates, and of how little infrastructure is needed to resell it once it has escaped.

What to Watch

  • Whether prosecutors disclose which breaches supplied the data and whether the affected organizations notify the people concerned.
  • Formal charges and the timetable for court proceedings.
  • Whether investigators pursue the service's paying users, who may still hold the records.
  • Copies of the database, or a successor service under a new name, surfacing elsewhere.