Estonia seeks Moroccan over one of the largest data breaches in the country’s history

Estonian law enforcement has issued an international arrest warrant for 25-year-old Moroccan citizen Adrar Khalid. He is suspected of unauthorized access to the customer database of the Apotheka pharmacy chain, as a result of which the personal information of hundreds of thousands of people was at risk.

• According to cyber police, the incident occurred in February 2024. The attacker is believed to have used administrator credentials to gain access to the customer database of Allium UPI, the company that operates the Apotheka pharmacy chain.
• Although the method of obtaining the passwords is still under investigation, there is reason to believe that the access was used to copy sensitive data. The prosecutor’s office has already filed an extradition request if the suspect is detained outside Estonia.

The leak compromised about 700,000 personal identification numbers, more than 400,000 email addresses, approximately 60,000 home addresses and 30,000 phone numbers. The database also contained records of purchases of over-the-counter medicines and pharmacy products dating back to 2014. There is no information on prescription drugs in the database. So far, no cases of misuse of the stolen information have been recorded.

The incident highlights concerns about the security of digital infrastructure, even in high-tech countries. Estonia, recognized as a leader in e-government, faces a serious challenge in the area of ​​personal data protection. The leak revealed potential weaknesses in loyalty systems used in the pharmaceutical sector.