Thomson Reuters
- A man in California was indicted for stealing customer and merchant data from Shopify, TechCrunch said.
- The man is facing charges of aggravated identity theft and conspiracy to commit wire fraud.
- Last year, Shopify fired two "rogue" workers for stealing customer and merchant data.
- See more stories on Insider's business page.
A California man has been charged with aggravated identity theft and conspiracy to commit wire fraud for stealing Shopify customer and merchant data.
A grand jury indicted the man, Tassilo Heinrich, who was about 18 during the alleged scheme, according to TechCrunch, which first reported the matter. TechCrunch confirmed the "victim company" listed in the indictment was Shopify with a person familiar.
Heinrich used stolen data, such as names, email and billing addresses, and payment methods, to set up fake merchant pages to take business from sellers, or he would sell the data to co-conspirators, who would use it to commit fraud against the merchants and their customers, according to the indictment.
During the scheme, which lasted at least a year, Heinrich worked with an accomplice, who was a customer support agent authorized to use Shopify's internal network, the indictment said.
Heinrich paid the agent in thousands of dollars of cryptocurrency, according to the indictment, which documented the payments.
Heinrich has pleaded not guilty, TechCrunch reported.
Shopify did not directly confirm to Insider it is the company involved in the Heinrich case, but said in a statement: "Shopify has cooperated with the FBI to investigate an incident involving the data of a small number of our merchants in September 2020. As previously stated, the perpetrators involved no longer work with Shopify. Because there is an active criminal investigation, we are unable to provide further comment at this time."
Last fall, two "rogue" workers from Shopify's third-party customer support team "were engaged in a scheme to obtain customer transactional records" of about 200 merchants, the company said. Shopify said the data included emails, names, addresses, and order details, but not "sensitive personal or financial information."
The company said it fired the employees and referred the incident to law enforcement.
Shopify, based in Ottawa, Canada, is a platform that allows business owners to set up online stores and sell their products to consumers. It now has more than a million merchants, according to the website.
About a fifth of Shopify sellers deserve a "caution" or "warning" sign for selling fraudulent items or not delivering orders, according to a January report from FakeSpot. Scammers can easily set up merchant accounts on Shopify that knock off the original sellers, too, the report noted.
In March, Insider reported that one Shopify merchant lost $55,000 in sales when her bank account information was unknowingly changed. The hacker received her sales for about a month until she and Shopify noticed the problem.
If you're a seller and believe you have lost money on Shopify because of a stolen or hacked account, reach out to the reporter of this article, Natasha Dailey at [email protected].