European police have arrested 10 people for allegedly hijacking mobile phones belonging to high-profile celebrities in the United States.
UK authorities detained eight people on Tuesday in England and Scotland, while two others had been previously detained in Belgium and Malta.
The EU police agency Europol said the criminal network is believed to have stolen personal information and more than $100 million (€82.4 million) in cryptocurrencies.
These attacks involved deactivating a victim’s mobile phone SIM card so that the number can be transferred to another card under the group’s control.
Europol said that “sim swapping” can be done either by fooling the phone company with “social engineering techniques” or by using a “corrupt insider”.
No celebrities have been named, but the attack is said to have targeted “well-known” personalities from the sports and music industry.
“The attacks orchestrated by this criminal gang targeted thousands of victims throughout 2020, including famous internet influencers, sports stars, musicians, and their families,” Europol stated on Wednesday.
The UK’s National Crime Agency (NCA) added that investigators had warned victims when they had been targeted and “where possible, prior to the criminals managing to cause any damage”.
The arrests followed a year-long international investigation by the United Kingdom, United States, Belgium, Malta, and Canada.
Investigators found that after accessing victims’ phone numbers, the criminals were able to take control of apps or accounts by requesting password reset codes sent via SMS.
They would then steal money, cryptocurrencies, and personal information, including contacts synced online.
“They also hijacked social media accounts to post content and send messages masquerading as the victim,” Europol said.
The eight suspects detained in the UK were all aged between 18 and 26, the NCA said in a statement.
“This network targeted a large number of victims in the US and regularly attacked those they believed would be lucrative targets,” said Paul Creffield, head of operations in the NCA’s National Cyber Crime Unit.
“In this case, those arrested face prosecution for offences under the Computer Misuse Act, as well as fraud and money laundering, and extradition to the US for prosecution.”
“As well as causing a lot of distress and disruption, we know they stole large sums from their victims, from either their bank accounts or bitcoin wallets.”
Europol warned that “sim swapping” is a growing threat carried out by fraudsters and that “it’s not just celebrities who are under attack”.
The agency has advised citizens to keep their devices’ software updated, limit the amount of data shared online and avoid suspicious emails or phone calls that request personal information.
