City of London Police have arrested seven teenagers due to their suspected connections with a hacking group that is believed to be the recently prolific Lapsus$ group, BBC News reports.
“The City of London Police has been conducting an investigation with its partners into members of a hacking group,” Detective Inspector Michael O’Sullivan of the City of London Police said in a statement to The Verge. “Seven people between the ages of 16 and 21 have been arrested in connection with this investigation and have all been released under investigation. Our enquiries remain ongoing.”
Lapsus$ has taken responsibility for some major security breaches at tech companies, including Nvidia, Samsung, Ubisoft, Okta, and Microsoft. On Wednesday, reports surfaced indicating an Oxford-based teenager is the mastermind of the group. City of London Police did not say if this teenager was among those arrested.
At least one member of Lapsus$ was also apparently involved with a data breach at EA, cybersecurity expert Brian Krebs reported on Wednesday in an extensive article about the group. Vice corroborated the group’s involvement in that breach in its own article on Thursday, noting that it was “emblematic of Lapsus$’s subsequent and massive hacks.”
The suspected mastermind’s identity was apparently revealed by angry customers doxing him. According to Krebs’ report, the group’s leader purchased Doxbin, a site where people can share or find personal information on others, last year, but was a poor owner of the site. He apparently gave up control in January but leaked “the entire Doxbin data set” to Telegram, and the Doxbin community retaliated by doxing him.
BBC News says it spoke to the teenager’s father, who was apparently unaware of his involvement with the group. “I had never heard about any of this until recently. He’s never talked about any hacking, but he is very good on computers and spends a lot of time on the computer,” the father said, according to BBC News. “I always thought he was playing games. We’re going to try to stop him from going on computers.”
Update March 24th, 12:05PM ET: Added City of London Police statement and additional context about the group.