7,600 sales, $232,000, and thousands of people who never knew

Rydox was a shop, run like one. You paid between $200 and $500 for a seller account, listed other people's Social Security numbers and logins, and the site kept 40 per cent of whatever you made.

Ardit Kutleshi, 28, a Kosovar national, has pleaded guilty in federal court in Pittsburgh to aggravated identity theft and money laundering conspiracy. The Justice Department announced it on 24 September. Court documents put Rydox at more than 7,600 transactions since at least 2016 and at least $232,000 in revenue, with roughly 18,000 registered users and, alongside the stolen personal data, hundreds of thousands of cybercrime tools and products listed. Sentencing is set for 9 February 2027. The money laundering count carries up to 20 years, the identity theft count a mandatory minimum of two.

The FBI's Pittsburgh field office seized rydox.cc in December 2024, with servers taken in Malaysia and arrests in Kosovo and Albania. Kutleshi's brother Jetmir pleaded guilty, was sentenced to time served and was deported.

What matters to the rest of us is where the stock came from. Almost none of it is the product of some cinematic break-in at a bank. It is names, addresses, Social Security numbers and passwords lifted from infostealer malware running on ordinary home computers, plus reused passwords dredged out of old breaches, sold in bulk for small money. Shutting one shop down does not retire the inventory, which is already out there and stays useful for years. A different password on every account, two-factor switched on for email and banking before anything else, and a hard look at what your browser has quietly saved. Tendvane's privacy and accounts check goes through the saved sign-ins and account settings on your PC and tells you what is actually sitting there.