Police in North Macedonia, working with the FBI, arrested the alleged administrator of OLVX, a stolen-data market with over 1,500 seller accounts1. North Macedonian police say the suspect ran the market, where criminals sell stolen data to one another. Taking the administrator rather than a seller goes after the platform those accounts relied on, as Hamburg-led police did when they seized the KillSec leak site and its servers on 30 September.
22OCT
North Macedonia holds alleged OLVX admin
1 min read
16:31UTC
Police in North Macedonia, working with the FBI, arrested the alleged administrator of OLVX, a stolen-data market with over 1,500 seller accounts.
TechnologyDeveloping
Key takeaway
North Macedonian police arrested the alleged administrator of the OLVX stolen-data market.
Deep Analysis
In plain English
OLVX was an online market where criminals bought and sold stolen personal data and login details. Police in North Macedonia, working with the FBI, arrested the man they say ran it. Taking out the person who runs a market can shut it for everyone who traded there.
Root Causes
Stolen-data markets concentrate trade in one place, which makes the administrator a single point of failure. North Macedonian police working with the FBI shows US investigators routing arrests through local forces where the suspect lives.
What could happen next?
- Opportunity
Records seized with the alleged administrator could identify OLVX sellers and buyers for follow-up cases.
First Reported In
Update #15 · Fridge hack spoils food in seven countries
The Record· 22 Oct 2026
Read original →Different Perspectives
Hospital Sírio-Libanês
Hospital Sírio-Libanês said a 21 September attack reached a reporting system for its social projects, possibly exposing patients' and staff identity numbers and health information, while its general patient database was untouched. It notified the ANPD and the Polícia Federal and warned of fraud attempts.
The Foschini Group
The Foschini Group told the Johannesburg exchange on 13 October that an attack found on 11 October disrupted IT systems at its TFG London brands, while stores stayed open. It has not identified the attackers or established whether personal data was taken.
FirstVDS
FirstVDS said attackers used a VMmanager 6 flaw to copy customers' passwords, cloud credentials and cryptocurrency wallets from beneath their virtual servers, and told notified customers to assume theft and rotate credentials. ISPsystem's flaw was not fully fixed on 19 October.
ESET
ESET says Russia-aligned UAC-0099 phished a Ukrainian grain logistics firm in July 2025 and apparently passed its access to GRU-linked Sandworm, which wiped the company's data that September. It treats the attackers' use of the Yggdrasil network as a first for a state-aligned actor.
JPCERT/CC
JPCERT/CC issued emergency alert AT-2026-0032 on 14 October as EG Secure Solutions confirmed attacks on the SiteGuard Server Edition flaw. It told operators to save diagnostic data before updating, because the update may erase traces of the attack.
Cyber Security Agency of Singapore
The Cyber Security Agency of Singapore said on 20 October that attackers are exploiting Ivanti Connect Secure, seven days after Ivanti's disclosure, having flagged PAN-OS exploitation on 16 October. It issued a PHP2Shell alert on 21 October, the day the fixes shipped.
Written with AI from Lowdown's published reporting. Not individually reviewed by an editor. Editorial standards.