On Friday, May 25, Judge Michael Gledhill of Southwark Crown Court sentenced Grant West, 26, to 128 months in prison for crimes committed as the Alphabay fraud vendor “Courvoisier.” The man, formerly known only as an Alphabay “full” vendor that allegedly scammed customers as frequently as he defrauded companies, caused several million dollars in damage to companies he attacked. And more than $1.6 million has disappeared, the judge said. Part of West’s sentence also involved the forfeiture of $666,000 in Bitcoin. That money, however, has already been seized by the Met’s Police Cyber Crime Unit.
Even though he targeted dozens of companies, targeting the food delivery service “Just Eat” led to his demise. It is not that the Met would not have arrested the Kent man for any number of crimes outside of the Just Eat phishing campaign. However, the case first brought the username “Courvoisier” to the surface and put a name to the face. The phishing emails sent to Just Eat customers netted a total of 63,000 debit cards and credit cards. He never needed to spend his own money. And those cards came from Just Eat alone.
He also targeted, among a whole list of others, AO.com, Uber, the Finnish Bitcoin exchange, Groupon, and T-Mobile. An Avios hack set British Airways back more than $400,000. He also stolen roughly $90,000 from Barclays accounts—all of which were incidents taken care of by the bank for more than $300,000. Many of West’s attacks and scams may have been technically trivial feats such as bruteforcing logins, SQL injections, and sending phishing emails. The companies that suffered West’s attacks considered them anything but insignificant, though.
The government also considered the sheer impact West’s perpetual attacks had on millions of innocent victims. The Met viewed him as the head of an Organised Crime Network. Authorities described him as a “one man cyber crime wave.” The head of the Met’s Organised Crime Command, Detective chief superintendent Mick Gallagher, said that the case “illustrates the lengths that our detectives will go to in order to pursue offenders on the dark web.” And that they “will use many different measures to ensure such offenders are identified, prosecuted and their assets are seized.”
His statements, given that the Met lost more than $1.6 million worth of West’s cryptocurrency almost immediately after they arrested him on a train to London. Surprisingly, the authorities had planned out the arrest in a manner similar to arrests of darknet marketplace owners and forum staff. They did not want West to lock out or destroy any evidence. While they successfully grabbed an SD card with millions of email addresses and matching passwords, they somehow failed to prevent West or one of West’s associates from hiding more money than they sentenced him to forfeit. West’s girlfriend, notably, walked away without a prison sentence.