You are here

A man in California was charged with identity theft and wire fraud for stealing Shopify data

Submitted by Tech Insider on April 8, 2021 - 11:32am

The logo of Shopify is seen outside its headquarters in Ottawa, Ontario, Canada, September 28, 2018. REUTERS/Chris Wattie

Summary List Placement

A California man has been charged with aggravated identity theft and conspiracy to commit wire fraud for stealing Shopify customer and merchant data.

A grand jury indicted the man, Tassilo Heinrich, who was about 18 during the alleged scheme, according to TechCrunch, which first reported the matter. TechCrunch confirmed the "victim company" listed in the indictment was Shopify with a person familiar.

Heinrich used stolen data, such as names, email and billing addresses, and payment methods, to set up fake merchant pages to take business from sellers, or he would sell the data to co-conspirators, who would use it to commit fraud against the merchants and their customers, according to the indictment.

During the scheme, which lasted at least a year, Heinrich worked with an accomplice, who was a customer support agent authorized to use Shopify's internal network, the indictment said. 

Heinrich paid the agent in thousands of dollars of cryptocurrency, according to the indictment, which documented the payments.

Heinrich has pleaded not guilty, TechCrunch reported. 

Read more: A 21-year-old 'dripping in dropshipping money' has sold over $1.7 million in products on Shopify. He now shares his biggest tips for making e-commerce profit.

Shopify did not directly confirm to Insider it is the company involved in the Heinrich case, but said in a statement: "Shopify has cooperated with the FBI to investigate an incident involving the data of a small number of our merchants in September 2020. As previously stated, the perpetrators involved no longer work with Shopify. Because there is an active criminal investigation, we are unable to provide further comment at this time."

Last fall, two "rogue" workers from Shopify's third-party customer support team "were engaged in a scheme to obtain customer transactional records" of about 200 merchants, the company said. Shopify said the data included emails, names, addresses, and order details, but not "sensitive personal or financial information."

The company said it fired the employees and referred the incident to law enforcement. 

Shopify, based in Ottawa, Canada, is a platform that allows business owners to set up online stores and sell their products to consumers. It now has more than a million merchants, according to the website. 

About a fifth of Shopify sellers deserve a "caution" or "warning" sign for selling fraudulent items or not delivering orders, according to a January report from FakeSpot. Scammers can easily set up merchant accounts on Shopify that knock off the original sellers, too, the report noted.  

In March, Insider reported that one Shopify merchant lost $55,000 in sales when her bank account information was unknowingly changed. The hacker received her sales for about a month until she and Shopify noticed the problem. 

If you're a seller and believe you have lost money on Shopify because of a stolen or hacked account, reach out to the reporter of this article, Natasha Dailey at ndailey@businessinsider.com.

Join the conversation about this story »

NOW WATCH: Why thoroughbred horse semen is the world's most expensive liquid

Full, story source published in: