Police suspect Moroccan national of downloading Apotheka customer data

Moroccan citizen Adrar Khalid is suspected of unlawfully accessing and downloading data from the customer card system managed by Allium UPI. Photo: Politsei

Estonia's Central Criminal Police and the Office of the Prosecutor General have identified and issued an international arrest warrant for Moroccan citizen Adrar Khalid, aged 25, who is suspected of unlawfully accessing and downloading data from the customer card system managed by Allium UPI in February last year.

The Office of the Prosecutor General requested the suspect's arrest. Harju County Court approved the request and issued an arrest warrant for Khalid, and the Central Criminal Police subsequently issued an international arrest warrant. If the suspect is apprehended in another country under this order, that country may extradite him to Estonia for prosecution.

Reemo Salupõld, head of the investigation group at the Central Criminal Police's cybercrime bureau, said there is reason to suspect that Khalid accessed the database by logging in with an administrator-level account. How he obtained the account password is still under investigation.

«No matter how long and complex a password is, this case shows that it is no longer enough on its own. Cybercriminals continue to find smarter ways to access accounts, so we recommend everyone use two-factor authentication -- it adds an extra layer of security that can be crucial if a password leaks or falls into the wrong hands,» Salupõld added.

So far, police have found no evidence that the downloaded data has been misused.

State Prosecutor Vahur Verte said that the theft of Apotheka customer data once again demonstrates that cybercriminals do not recognize borders, and the data of Estonian companies and residents are also targeted by criminals operating outside Estonia.

The theft affected nearly half the Estonian population last year, making it one of the most extensive data breaches in recent memory. The Office of the Prosecutor General and the Central Criminal Police have been working for a year to identify the suspect behind the breach.

«This crime affected a large number of people directly and undermined the public's sense of security, so it is important that the evidence collected has brought us closer to a court's assessment of the suspect's actions,» Verte said.

Over the past year, the Central Criminal Police's cybercrime bureau has identified suspects behind several major cyberattacks. It has issued international arrest warrants for Russian nationals suspected of cyberattacks on Estonian government institutions five years ago, for another Russian national behind the 2022 Asper Biogene data breach, and now for a Moroccan national suspected in last year's Apotheka customer data theft.