The Central Criminal Police and the Office of the Prosecutor General have initiated an international search for a Moroccan citizen suspected of last year unlawfully accessing and downloading data from a customer card system managed by Allium UPI.

Allium UPI is the parent company of the Apotheka pharmacy chain.

Based on evidence collected in the criminal proceedings, 25-year-old Moroccan citizen Adrar Khalid is suspected of illegally downloading data from the Allium UPI database, in February 2024.

Reemo Salupõld, head of the investigation group at the Central Criminal Police's cybercrime bureau, said there is reason to suspect that Khalid gained access to the database by logging in with an account that came with administrator privileges. How the suspect came to obtain the password for that account is still under investigation.

Salupõld said: "Regardless of how long and complex a password is, this case clearly shows that this is no longer sufficient on its own today. Cybercriminals are finding increasingly ingenious ways to access accounts, which is why we recommend everyone use two-factor authentication – this adds an extra layer of protection that can be crucial if a password does get leaked or ends up in the wrong hands."