Estonia issues international warrant for Moroccan suspect in loyalty card data breach

Estonian authorities have issued an international arrest warrant for a 25-year-old Moroccan national accused of hacking into a loyalty card system and stealing the personal data of hundreds of thousands of customers, officials announced this week.

According to Estonia’s public broadcaster ERR, the suspect, identified as A.K., is believed to have illegally accessed a database managed by Allium UPI, a company specializing in pharmaceutical and hospital supply distribution. The breach occurred in February 2024 and involved the unauthorized extraction of sensitive customer information from loyalty programs operated by Apotheka, Apotheka Beauty, and PetCity.

Investigators say the hacker used an administrator-level account to access the system, although it remains unclear how the credentials were obtained. Authorities continue to investigate the source of the password compromise.

The breach exposed a significant volume of personal data, including nearly 700,000 personal identification codes, more than 400,000 email addresses, around 60,000 home addresses, and approximately 30,000 phone numbers of registered loyalty card holders.

Reemo Salupõld, head of the cybercrime bureau at Estonia’s Central Criminal Police, said the incident underscores the growing inadequacy of relying on passwords alone for digital security. He emphasized the importance of implementing two-factor authentication as a basic measure to protect against unauthorized access.

So far, officials report no evidence that the stolen data has been misused. However, the Prosecutor General’s Office requested the suspect’s arrest, and Harju County Court approved the motion, adding A.K. to an international wanted list. Should he be detained abroad, Estonia intends to pursue extradition.

This case is one of several high-profile investigations currently being handled by Estonia’s cybercrime bureau. Authorities have also issued international warrants for multiple Russian citizens linked to previous cyberattacks against Estonian government institutions and to a data breach at Asper Biogene, a genetic research firm, two years ago.