A cyber crook illegally accessed the details of hundreds of thousands of people after hacking the websites of 17 big firms including Sainsburys, Uber and Just Eat.
Grant West, 25, admitted illegally obtaining the details of 165,000 Just Eat customers’ accounts alone in a bid to sell them on the ‘dark web’ for Bitcoins.
No financial details were obtained, but a court heard it cost Just Eat £210,000 alone in repairs and mitigation costs.
West hacked the 17 websites, which included Ladbrokes, Asda, T Mobile, Argos, Coral, Groupon and Nectar, by “brute force attacks” using the software Sentry MBA.
He also plotted to defraud companies by obtaining customer data, such as email addresses and passwords, known as “Fullz” – or full credentials – to sell on the dark web using his profile named ‘courvoisier’.
West even tried to sell cannabis online while he was on bail awaiting trial for the Just Eat fraud, Southwark Crown Court heard.
When police arrested him in August and September this year they found he had £25,000 in cash and a significant amount of Bitcoins.
He converted his criminal proceeds into Bitcoin, which he moved around internationally.
West, who lives on a caravan park in Minster on the Isle of Sheppey, admitted a string of charges of conspiracy to defraud, computer hacking, money laundering and drugs offences.
He appeared wearing a grey Puma jumper and grey tracksuit trousers, tapping his fingers on the side of the dock in a typing motion.
West was helped by his barrister Anna Mackenzie as he entered his pleas to the 10 counts.
Kevin Barry, prosecuting, said: “It’s computer hacking, and associated fraud.
“His acquiring, obtaining, using and supplying false customer credentials, everything one needs in order to manipulate identities alone.
“The particular type of computer misuse was activity which required details which could then be used and supplied onwards.”
The drugs charges arose after West entered a not guilty plea to defrauding Just Eat in May.
Mr Barry said: “Mr West was on bail. There were further arrests.
“There was online surveillance carried out, which exposed he was allegedly carrying out similar attacks.
“Further arrests found drugs in his possession. But moreover, and more importantly, exposed that he was selling them online as part of his online activities, and alongside the customer details.
“He had a shop on the dark web, where he had an identity. From that shop he was selling not only computer access credentials, details, but also alongside it – on another shelf if you like – he was selling drugs which were posted out to customers.”
West admitted two counts of conspiracy to defraud, one count of computer hacking, and one count of attempting to supply a Class B drug.
He also pleaded guilty to offering to supply a Class B drug, one count of possessing a Class B drug with intent to supply, and one count of possessing a Class B drug.
West also admitted two counts of possessing criminal property and one count of money laundering.
West admitted conspiracy to defraud Just Eat and its customers by obtaining their data, and using it to facilitate fraudulent transactions, whether directly or indirectly following transmission of the data to others, between July 1 and December 8 2015.
He also pleaded guilty to conspiracy to defraud “corporations, companies, partnerships, firms and persons”, which sell online, by obtaining, using and supplying data known as “Fullz”.
West admitted hacking 17 websites, between August 25 and September 30 this year, by using “brute force” attacks using Sentry MBA.
The companies were Sainsburys, Nectar, Groupon, AO.com, Ladbrokes, Coral betting, Uber, Vitality, RS Feva Class Association 2017, Asda, the British Cardiovascular Society, Mighty Deals Limited, Truly Experiences Ltd, T Mobile, M R Porter, the Finnish Bitcoin exchange and Argos.
He admitted attempting to supply cannabis on March 21 this year, and offering to supply the Class B drug between October 1 2015 and September 30 2017.
He pleaded guilty to possessing 123.05g of cannabis or cannabis resin on August 16 2017, as well as having 181.56g of cannabis and cannabis resin on September 30 this year.
West admitted having £3,980 in cash on August 16 2017, knowing or suspecting it to be from crime, as well as £21,388.67 on September 30 this year.
And he pleaded guilty to money laundering a quantity of Bitcoins between January 1 2015 and September 30 2017.
West was remanded in custody until he is sentenced by Judge Joanna Korner QC.