WickedGen: The Site That Sold Stolen Streaming Logins
A cheap streaming account sounds like a bargain. For the people whose logins were sold, it was theft, and the same stolen logins feed bigger attacks.
By Siddharth ShankarUpdated October 11, 2026The AFP says a 23-year-old Sydney man who ran WickedGen.com and related sites was sentenced in April 2021 to 2 years and 2 months, served as an intensive corrections order, and that $1.66 million was forfeited to the Commonwealth. The services had at least 152,863 registered users. He received more than $680,000 via PayPal. See how credential stuffing works.
Your email is the key to most of your accounts. Has it already leaked?
Free · About 30 seconds · No sign-up · Email not stored
Stolen logins are the raw material for many online crimes. Some are used to drain accounts. Others are packaged and resold in bulk. This Australian case concerned the second kind.
What happened
The AFP says a Sydney man conspired with a man in the United States to steal streaming-service login credentials and resell them cheaply. He ran WickedGen.com for about two years and also created or ran HyperGen, Autoflix and AccountBot.
He pleaded guilty in October 2020 and was sentenced in April 2021 to 2 years and 2 months, served as an intensive corrections order. The release was published on October 29, 2021, and the forfeiture order was made the week before.
How it worked
Across four services the sites had at least 152,863 registered users and provided at least 85,925 subscriptions. The FBI indictment alleged the conspiracy to create and run AccountBot ran from February 2018 to March 2019.
The man received more than AUD $680,000 via PayPal and converted some of it to cryptocurrency. The accounts that were sold belonged to unknowing victims in Australia and overseas.
What was exposed
Login credentials were harvested and sold. The release does not say how they were stolen. The same stolen credentials are also what credential stuffing attacks depend on, a link the release does not draw but that is worth knowing.
An owner of a streaming account may lose little except access and a charge. But if the same password protects an email or bank account, the exposure is much larger.
How it ended
The ending is relatively good. $1.66 million was forfeited to the Commonwealth, including over $1.2 million in cryptocurrency. The man received a sentence of 2 years and 2 months as an intensive corrections order. The release does not describe any payments to account holders.
A timeline of the case
The FBI indictment alleged the AccountBot conspiracy ran from February 2018 to March 2019. The Sydney man pleaded guilty in October 2020, was sentenced in April 2021 and, around the week before October 29, 2021, a forfeiture order was made. The AFP release followed.
The case therefore ran for more than three years from the alleged conduct to the order that took the money. Asset forfeiture happens after conviction and can take time, but in this case it recovered a large sum.
Quick check before you read on: is your email in a known data breach? Free, about 30 seconds.
Free · About 30 seconds · No sign-up · Email not stored
Key facts at a glance
- Sentence: 2 years and 2 months, served as an intensive corrections order (April 2021)
- Forfeited: $1.66 million, including over $1.2 million in cryptocurrency
- Registered users: at least 152,863 across four services
- Subscriptions provided: at least 85,925
- Income: more than $680,000 via PayPal
- AFP release: October 29, 2021
Why this case matters
It shows an economy around stolen credentials: some people steal, others resell, and customers who buy cheap accounts help fund it. A buyer may think only of saving money, but the account came from someone who did not agree to sell it.
It is also a reminder that your login can be sold without any dramatic breach of a large company. Individual accounts can be stolen one by one.
What you can do
1Use a unique password for each service
2Turn on two-factor authentication
A stolen password then does not open the account.
3Check your sign-in history
Look for devices or locations you do not recognize.
4Avoid buying shared or cheap accounts
They are often stolen. Check whether your email has been in a breach with our guide to checking your email.
The cooperation behind the case
The AFP worked with the FBI because the conspiracy involved a man in the United States. That cross-border link explains how a Sydney resident came to be charged for a service whose customers were around the world.
For individuals, the point is that stolen credentials are an international commodity. A login stolen in one place can be sold in another within hours, so a quick password change is more effective than waiting to learn how the theft happened.
What the release does not say
The release does not say how the credentials were taken. For a UK case involving a genetic data service, see the 23andMe fine.
Related reading that helps with cases like this: how credential stuffing works, how to check whether your email has been exposed and what to do after your email appears in a breach. You can also try our free email exposure check.
Sources
- Australian Federal Police: $1.6 million forfeited following AFP and FBI investigation (sentence, $1.66 million, 152,863 users, $680,000 via PayPal)
Frequently asked questions
What did the WickedGen sites sell?
Stolen login credentials for streaming services, resold cheaply.
How many users did the sites have?
At least 152,863 registered users across four services, according to the AFP.
What was forfeited?
$1.66 million, including over $1.2 million in cryptocurrency.
Why do stolen streaming logins matter?
If the same password protects other accounts, a leak can unlock them, and credential stuffing attacks rely on such stolen logins.
See if your email has already leaked
- Checks your email against known data breaches
- Shows which sites leaked it, when, and what leaked
- We do not store the email you check
Compare data removal services
See which services work in your country, what they cost, and the free do-it-yourself route.
Compare removal services →Prefer a one-time report first? Scan My Shadow, our sister service, $9.99.