Genesis Market: Police shut down website that sold personal data

One of the world's largest criminal markets used by online fraudsters to buy passwords has been shut down in a global law enforcement operation.

Genesis Market was selling logins, IP addresses and other data that made up the “digital fingerprint” of victims, allowing fraudsters to access bank and trading accounts.

Coordinated raids were conducted by law enforcement agencies around the world, including the UK. The UK's National Crime Agency (NCA) arrested 24 people suspected of using the site during the raids, including two men from Grimsby, Lincolnshire.

Law enforcement agencies from 17 countries, including the United States and the Netherlands, joined forces in the operation. The operation was led by the US FBI and the Dutch National Police, along with the UK's National Security Service, the Australian Federal Police and European countries. They conducted 200 searches and arrested 120 people.

On Wednesday, everyone who visited the Genesis Market website saw a message: “Operation Cookie Monster. This website has been seized”. Genesis Market had put up 80 million sets of credentials and digital fingerprints for sale, which the NCA called “a large enabling environment for fraud”.

“For too long, criminals have been stealing IDs from innocent citizens”, said Robert Jones of the NCA. “Now we want criminals to be afraid that we have their IDs, and they should be”, he added.

The Dutch police have created a portal where citizens can check whether their data has been compromised. Genesis Market operated on the open Internet, not just the dark web, and was created in 2017 with a user-friendly English-language interface.

It was a one-stop shop for buying login credentials, which made online fraud possible. The logins for sale included passwords to Facebook, PayPal, Netflix, Amazon, eBay, Uber, and Airbnb accounts. Criminals who bought this data even received notifications from Genesis when passwords were changed.

Genesis provided a specially crafted browser that used the stolen data to mimic the victim's computer, allowing fraudsters to log into accounts without security alerts.