Vinted, the online second-hand giant , has been under a violent attack by cybercriminals for the past few days. The accounts of hundreds of users are methodically siphoned off before disappearing and becoming untraceable. Vinted claims to be in contact with the victims for future compensation.

It was almost amazing that it hadn’t happened yet. With 23 million subscribers in France alone, the second-hand sales and purchase platform Vinted is currently the target of cybercriminal acts. Hackers steal the contents of users‘ virtual wallets, reveals Le Parisien this Thursday, March 23. One in three French people with an account is an attractive target for thieves. Hundreds of victims are already to be deplored.

“On Tuesday, I had already received a dozen alerts. The next morning, I had 200 messages in one night”, testifies Marianne Leleu, employee of the Lithuanian application for eight years in charge of hacks and currently at the head of a special Instagram account Vinted. “This modus operandi already existed but it was not as massive, she says. For the past two days, it is downright a network that has been organized. The Instagrammer assures that Spanish and Italian victims have also been reported to her.

In fact, the hacking method is none other than “phishing”, “phishing” in French, this method which consists in attracting a prey by sending a fraudulent SMS or email most often inviting him to click on a link. In this case, Vinted users who have been victims of hackers in recent days have received a phone call or an SMS with a four-digit code necessary to change their contact details on Vinted. Others received an email telling them directly that their contact details had been changed. In this specific case, the thieves have already served themselves.

Worse still: “We have testimonies from victims who could not see anything, for whom the criminals just changed the bank details and patiently waited for the transfer made by the users”, tells Marianne Leleu at Parisian. However, the Ile-de-France newspaper recalls that the application does not request any confirmation code to transfer the money from its Vinted wallet to its bank account. This makes it easier for cyberpirates…

The online second-hand giant, for its part, affirms to Parisian that “the connection information used (usernames, passwords) were obtained from data consulted elsewhere outside the platform and not linked to Vinted”. The company also ensures that it is in contact with the members who are victims of the scam “in order to support them in restoring access to their accounts”.

The problem is that some victims have had their Vinted access blocked by the platform after the thieves have published pornographic content on their accounts. Difficult then to get in touch with the platform. For now, Vinted is talking about compensation “in case of money lost on the wallet” of the victims of the scam. Their money would have jumped, transferred to Germany, Luxembourg or Ireland, a way to cover their tracks before disappearing.