On Air Now
Early Breakfast with Jenni Falconer 4am - 6am
3 May 2018, 08:47
A man from the Isle of Sheppey's admitted stealing thousands of peoples' debit and credit card details.
Grant West, 25, got hold of the personal data of 165,000 users from online takeaway service JustEat over a five-month period between July and December 2015 after hacking its database.
Newly released footage shows West being seized by officers in the act of accessing the dark web in a first class train carriage in September last year after months of surveillance.
He had been returning from a trip to visit his girlfriend and co-defendant 26-year-old Rachael Brooks in north Wales.
Just Eat have said no financial information was obtained in West's fraud, but pegged the cost of combating the attack at more than £200,000.
West used the information as part of a phishing campaign in a bid to obtain identity details known as "Fullz".
Using the stolen email addresses, West and his associates sent out emails designed to look like they came from Just Eat with offers of cash rewards in exchange for customers filling out a survey.
Respondents were asked to confirm personal emails and supply extra details in order to obtain the cash reward, which was then harvested by West.
The information, which included everything needed to make purchases online, was then advertised and sold to customers from his dark web shop.
West, who used the online identity "Courvoisier", also sold cannabis, which was delivered to customers.
Much of his business was carried out using Bitcoins - the valuable cryptocurrency.
He was due to be sentenced on Wednesday, but the sentencing was adjourned until May 25.
Beside him in the dock was mother-of-one Ms Brooks.
Ms Brooks, of Denbigh, north Wales, was originally charged with involvement in the Just Eat fraud, but the case was dropped and she pleaded guilty to a lesser charge of unauthorised use of computer materials.
She admitted using the details of two of West's victims to buy herself a £40 bikini online.
Handing her a community order, Judge Michael Gledhill QC acknowledged that she was vulnerable after the end of a previous relationship, saying "you fell into the arms of a villain and a rogue".
But he criticised her, saying: "You, knowing what he has done, are clearly still in a relationship with him".
He said she knew "perfectly well" the details had been stolen and she had no right to use them, adding "you should be thoroughly ashamed of yourself".
Police surveillance of West's operations revealed he was also selling details harvested from US and Australian citizens, account details of various other companies and even his own guide on how to carry out a cyber fraud.
When the first site was taken down by the FBI, he set it up elsewhere on the dark web to keep his business going.
West, who was living in a caravan park in Sheerness in Kent, built up huge caches of Bitcoin and other cryptocurrency in online "wallets".
He also had £25,000 in cash which was seized by police during a raid on his home.
The Bitcoin wallets were later emptied by a person who has never been traced - investigators estimate they would have been worth £1.5 million at its current valuation.
He admitted conspiracy to defraud Just Eat and its customers along with a string of other charges related to his dark web shop at Southwark Crown Court in December.
A hacking charge states West launched "brute force" attacks against 17 different websites using specialist software in a bid to obtain personal information.
Companies attacked included supermarkets Asda and Sainsbury's, bookmakers Ladbrokes and Coral, and internet-based firms, such as Groupon and Uber.
Other targets included Nectar, T Mobile and Argos.
West originally denied conspiring to defraud Just Eat in May 2017 and was released on bail, but continued his illicit online trade.
As well as the £25,000 in cash, police found his stash of cannabis when they searched his property in August and September last year.
West admitted two counts of conspiracy to defraud, one charge of computer hacking, four charges relating to the possession and supply of cannabis, two counts of possessing criminal property and one count of money laundering Bitcoins.