Polish Authorities Arrest Hacker Behind 2018 Morele.net Data Breach After Eight-Year Manhunt Polish cybercrime authorities have arrested a 29-year-old hacker linked to one of the country’s largest data breaches, the 2018 attack on Morele.net, a major Polish online electronics retailer. The suspect, charged with unlawfully obtaining and disclosing personal data, was apprehended on January 30, according to Commander Marcin Zagorski of the Central Bureau for Combating Cybercrime. The breach, which exposed the personal information of over 2 million users, included names, contact details, addresses, and hashed passwords. The hacker has reportedly admitted to the offenses, facing potential penalties of up to two years in prison. The case, one of Poland’s most significant cyber incidents, had remained unresolved for nearly eight years before the arrest. Authorities confirmed the development on February 9, 2026, marking a key milestone in the investigation. The breach’s scale and prolonged evasion of law enforcement had drawn widespread attention to cybersecurity vulnerabilities in the region.

Polish Hacker Charged in 2018 Morele.net Data Breach Affecting 2.5 Million Customers A 29-year-old Polish man has been charged in connection with a 2018 data breach of Morele.net, a major Polish e-commerce platform specializing in electronics and home appliances. The breach exposed the personal details of approximately 2.5 million customers, including names, email addresses, phone numbers, home addresses, and MD5crypt-hashed passwords. While payment card data remained secure, around 35,000 victims had highly sensitive information such as national ID numbers, financial details, and income data compromised. Poland’s Central Cybercrime Bureau (CBZC) filed charges on 30 January 2026, following an extensive investigation that had initially stalled before new evidence emerged. Authorities traced the attack back to the suspect, who has since admitted responsibility. The breach was later weaponized by fraudsters, who targeted victims with phishing SMS messages demanding small payments and stealing banking credentials. Morele.net, which refused to pay a ransom, faced a €645,000 GDPR fine in 2019 for failing to detect unusual network traffic a penalty later annulled by Poland’s Supreme Administrative Court due to procedural deficiencies. The case underscores law enforcement’s growing ability to revisit cold cybercrime cases as digital forensics techniques advance. The suspect now faces potential legal consequences for the attack, which sent shockwaves through Poland’s online retail sector.