Two men face charges of aggravated data breach in Oulu District Court

Two men in their twenties are facing charges of aggravated data breach in a trial that began at the Oulu District Court on Monday. According to the prosecutor, the men devised a method in early 2020 to infiltrate unsuspecting Finnish Omaposti accounts successfully. One of the accused downloaded a “combo list” containing millions of usernames and passwords, as well as the Sentry MBA application used in cyberattacks. The prosecutor alleges that the men tested which accounts from the list could access the Omaposti service, resulting in several successful hits.

This type of attack is known as a “brute force” assault, where the application tests each username individually to see if it can gain entry to the target website, in this case, Omaposti. Such attacks are effective because many people use the same credentials across various services. If an account’s information leaks online, it can lead to further breaches on other platforms.

As reported earlier by Kaleva, the data exploited in the Omaposti incident did not originate from the Postal Service’s servers but had leaked from another source. The prosecutor states that the men used the compromised Omaposti accounts to create fake invoices, which were paid using third-party bank information and credit obtained through fraudulent means, with some payments successfully processed while others were halted by the Post.

Both men have admitted in police interrogations to using the Sentry MBA software and committing the data breach but dispute the severity of the charges, with one claiming he was merely complicit in the other’s actions. They both deny aggravated data breach charges, claiming their actions amount to a lesser offense.

In addition to the data breach, both accused also face numerous counts of fraud related to payment instruments and are suspected of using stolen personal and banking information for taxi rides and online clothing purchases. Their defense is challenging certain charges, asserting that some may be obsolete and arguing for lighter sentences. The prosecution seeks substantial prison terms for their crimes. The court proceedings are ongoing, with a verdict to be delivered later.