Stolen data that could be used for fraud on the other side of the world has been sold for years on marketplaces run by people from the Balkans. Cases uncovered in Kosovo and North Macedonia suggest thousands of buyers and sellers facilitating the trade. Experts say the potential for profit and the difficulty of prosecution make the activity attractive, while closing a marketplace does not necessarily stop the trade.
In the online data markets, run by individuals from the Balkans, the purchased goods were not sent by mail and payments were not made in dollars or euros. On these websites, thousands of people created accounts and deposited cryptocurrency to buy packages of stolen personal data. These packages contained everything from names, addresses and phone numbers to banking details and login details for various subscription websites. One of these markets was called OLVX.
A 20-year-old man from the village of Reçicë e Madhe in Tetovo, North Macedonia, was arrested in October for his administration. The arrest was preceded by a joint investigation by local authorities and the US Federal Bureau of Investigation (FBI). According to the FBI, during the years 2023–2025, there were more than 1.500 accounts on this platform that sold stolen data. The arrest of the young man in North Macedonia came nearly two years after the arrest in Kosovo of two brothers, Ardit and Jetmir Kutleshi.
They ran Rydox, another illegal marketplace that sold stolen data and software to commit online fraud. A third Kosovo citizen, Shpend Sokoli, was arrested in Albania as an associate of the Kutleshi brothers. Rydox operated from 2016 to 2024. According to the FBI, over 7.600 transactions were carried out through it, while the US Department of Justice estimates the proceeds at at least $232.000. Both brothers pleaded guilty to US justice. One was convicted, while the other is awaiting sentencing. The Rydox marketplace was run by three Kosovo citizens, but the Kosovo Special Prosecution Office told Radio Free Europe that the investigation into the case “has not yielded any evidence that any Kosovo citizen was harmed.”
According to US authorities, in both cases the victims were American citizens whose personal data was stolen and sold. Authorities in Kosovo have not provided RFE/RL with information about the cases specifically investigated for data theft and their criminal prosecution.
Meanwhile, North Macedonian authorities told REL that reports of computer fraud have increased from 12 in 2022 to 79 in 2025, more than sixfold. However, the Rydox case and the arrest of the young man from North Macedonia raise questions about the extent of cybercrime in the Western Balkans: how is personal data obtained, how does it end up for sale online, and what enables these illegal markets to function?
HOW DOES TRADE WORK?
Thomas Holt, a professor of criminal justice at Michigan State University, explains that these markets are largely fueled by data leaks of varying sizes, caused by hacking attacks, including those carried out with the help of specialized software. Holt studies hacking and the organization of online criminal markets, and also directs the university’s center for cybercrime research and training. “Once the information is secured, it is sold. And this is often done through intermediaries,” he tells Radio Free Europe. Holt explains that the administrators of these markets are not necessarily also sellers or buyers of the data.
Another way to obtain data for these markets is to deceive the user himself. The US National Institute of Standards and Technology, NIST, explains that fraudulent messages, known as “phishing”, can appear to come from a bank. Through them, the recipient is encouraged to open a fake page and type in their username and password. Thus, without realizing it, they hand over this data to the attacker. Such messages can also encourage the user to download programs that steal data from their device. In recent months, frauds have been reported in Kosovo through fake SMS messages in the name of banks, aimed at stealing citizens’ data and money. In North Macedonia, fake messages via SMS and email are also among the most widespread forms of fraud, according to the Ministry of Internal Affairs of this country. The ministry also mentions the theft of bank data, cryptocurrency investment scams and the use of artificial intelligence-generated fake videos, known as “deepfakes.” According to NIST, using the same password on multiple accounts increases the risk: if it is discovered on one of them, it can be used to access others.
Holt warns that personal documents posted on social media can be used by others to commit fraud on behalf of the person they belong to. He compares this publication to showing your passport or driver’s license to others in a bar or cafe. “But for whatever reason, some people think it’s okay to do it online,” he says. Part of the supply to these markets also comes from programs that automatically steal information from devices, known as “infostealers” or data thieves. KELA, a company specializing in collecting and analyzing information on cyber threats, identified over 4,3 million infected devices and over 330 million compromised login credentials in 2024. It published the findings in April 2025, in the report “Inside the Data Stealing Program Epidemic.”
Despite the difficulties in measuring the illegal data trade in a structured way, experts say the way it is organized bears similarities to regular online businesses. “Most data marketplaces currently operate like any other e-commerce platform,” says Holt. He says there are discounts for regular customers, reviews from buyers, and intermediaries who can hold payment until the deal is complete. Since the activity is illegal, participants need to build trust within the network. “Trust is generally built by building a reputation around your username or nickname,” explains Holt.
Although this illicit trade is often associated with hidden parts of the internet, known as the dark web, Holt says that accessing these markets doesn’t always require access to hidden networks. A lot of personal data is also available on regular websites. David Maimon, a professor of criminal justice and criminology at Georgia State University and the head of cybersecurity company SentiLink, agrees that the trade isn’t limited to the dark web. He says markets like these in the Balkans were accessible on the regular internet, known as the “clearnet.”
Maimon studies illegal markets and attempts to use stolen identities at financial institutions, including those like Rydox and OLVX, which he said were “small, cheap” markets. “They offered identities for sale for $2 to $20,” he tells Radio Free Europe.
By “identity,” he means a package of information about a person: name, date of birth, and social security number, which is used for identification in the U.S. The price varies if driver’s license data or credit history is also included. The value to the buyer lies in the ability to use the information further. “They try to use our identities to create businesses and then apply for new credit cards or new loans,” Maimon explains.
He describes cases where fraudsters open bank accounts with stolen identities. They initially make regular payments to build credibility for their activity. Then they apply for credit and walk away with the money. But buying does not guarantee success. “The fact that an identity has been offered for sale on this market and someone has even bought it does not necessarily mean that someone has managed to use it successfully,” he emphasizes. This, according to Maimon, also makes it difficult to calculate the financial damages from this industry. So far, according to experts, no detailed analysis has been done on who the biggest victims of data leaks are from around the world. However, in the markets analyzed by NordVPN, a well-known company that provides virtual private network (VPN) services, most complete identity packages come from the US.
FROM THEFT TO SALE, AN INTERNATIONAL CHAIN
The opportunity to make money and the perception that the law is not being enforced properly make the trade in stolen data attractive to people from the Balkans, especially young people, according to Alex Holden. Holden is a US-based cybersecurity expert and founder of Hold Security, a company that specializes in researching criminal networks and stolen data markets. He explains that common language, cultural proximity and personal acquaintances help create local cybercrime communities. Over time, these communities can forge connections across borders and expand their activities internationally. “That’s why we see so many examples of cybercrime from the Balkan Region,” he says.
Holt also highlights the difficulties in combating this activity. He explains that countries with limited investigative resources “may not pay much attention to stolen data markets and, instead, focus on other problems.” In an analysis of Southeast Europe, published in August 2024, the Global Initiative against Transnational Organized Crime (GI-TOC) highlighted a lack of resources and expertise in Southeast European countries to investigate and prosecute cybercrime, which makes them more vulnerable. Cryptocurrency payments complicate investigations of these online crimes. In the Western Balkans, investigations are also hampered by a lack of expertise and clear procedures for handling cases involving cryptocurrency, according to GI-TOC. Cases uncovered in Europe show that this trade extends beyond platforms linked to the Balkans. (RFE)