Man Used Stolen Netflix Credentials to Acquire Content For Torrent Site

As part of a campaign against torrent sites in Denmark, local anti-piracy group Rights Alliance (Rettigheds Alliancen) targeted several members-only torrent trackers.

Early November 2021, the Public Prosecutor for Special Economic and International Crime (SØIK) announced that six people had been arrested following criminal referrals by Rights Alliance. All were members and/or operators of ShareUniversity and DanishBytes. One of those arrested was a 33-year-old man from Denmark.

Man Progressed From Site User to Staff Member

Following his arrest one year ago, this week Rights Alliance revealed more information about the now 34-year-old from Aalborg. The anti-piracy group informs TorrentFreak that the man was initially just a regular DanishBytes user but was later promoted to the site’s staff.

His position on the DanishBytes team led him to provide IT support to the site’s users. At that time the members-only torrent site offered more than 10,000 copyrighted works to around 5,000 members and, in common with similar sites, not all users understood how everything worked. Rights Alliance says the man did other work too.

Content Acquisition and Hacking

The anti-piracy group says the man was “active in file-sharing” and an uploader on DanishBytes. When users requested specific content to be made available, which included pirated copies of Danish weekly newspapers, the man fulfilled the requests when he could. But there was another side too, one usually hidden from public view.

The prosecution’s case included evidence that the man also uploaded video content to DanishBytes. The content was acquired from legal streaming services including Netflix and TV 2 Play, a subscription channel owned by the Danish government. Anyone can legally sign up to these platforms but obtaining content from them carries risks when redistribution is the end goal.

The man countered these threats by obtaining streaming service login credentials himself via hacking, and by downloading lists of credentials offered by other hackers. These lists typically contain email addresses and passwords exposed due to a data breach. When users deploy the same username/password combination across sites, all of their accounts face potential exposure.

In this case the DanishBytes user avoided paying for Netflix and TV 2 Play while ensuring that any copies he made would be associated with innocent users’ accounts. Rights Alliance couldn’t confirm if any copies were traced using watermarking or similar means. HOwever, it did confirm that the man’s role as a staff member on DanishBytes ended with him being kicked out after two months.

Convicted and Sentenced

Having been convicted for his offenses on DanishBytes and those related to hacking, this week the man appeared for sentencing.

“At the court in Aalborg, a 34-year-old man from Aalborg has been sentenced to 3 months’ probation and 80 hours of community service, as well as confiscation of IT equipment, including for having participated in the operation of the illegal file sharing service DanishBytes,” Rights Alliance reports.

Rights Alliance Thanks ‘Danish FBI’

Founded in 2020 with a vision to create a Danish version of the FBI, DSK (National enhed for Særlig Kriminalitet) is a police unit focused on cybercrime, organized crime, and related financial crime. Following this week’s sentencing, Rights Alliance director Maria Fredenslund thanked the ‘Special Crime Unit’ for its work on the DanishBytes case.

“NSK, the Section for Legal Protection, has been enormously effective in catching and bringing the masterminds behind DanishBytes and other illegal Danish file-sharing services to court, as well as shutting down the illegal services. In this case, we have seen the hacking of the private data of ordinary Danes with the aim of accessing and retrieving content and then spreading it illegally,” Fredenslund said.

“NSK’s efforts have helped to clarify how password hacking is used to give birth to the illegal services with content, and it is gratifying that the masterminds are now being held accountable for their crime, which has consequences for the content industry as well as for the Danes who get their credentials hacked.”

The sentence handed down to the DanishBytes user is broadly in line with those handed down recently in similar cases. However, those cases did not feature hacking or stolen credentials so the sentence is likely to be considered lenient.