Cyber Threat Actor: 15-year-old Merseyside boy

The threat actor is known publicly by the alias "15-year-old Merseyside boy" and is located in the United Kingdom, specifically in the Merseyside region. This identifier emerged from a law enforcement press release following an arrest in August 2020. No other names or affiliations have been disclosed in open sources.

The actor’s known activity involved the alleged compromise of multiple PayPal accounts belonging to users in the United Kingdom. The targeting was limited to the financial services sector, with PayPal as the specific platform. Authorities described the objective as unauthorized access to accounts, which they linked to potential financial gain.

During the search of the suspect’s residence, police seized a variety of high‑value electronic devices, including iPhone models, an Apple Watch, AirPods, an iPad, several Samsung and Sony phones, and a mini motorbike. The seizure of these items was cited as evidence suggesting the actor may have profited from the illicit activity. No specific malware families, exploit tools, or initial access vectors were mentioned in the reporting.

Publicly available information does not indicate any state sponsorship, membership in a criminal consortium, or other affiliations for this individual. The case was handled by the Merseyside Police Cyber Dependent Crime Unit assisted by the Matrix team, but no further organizational ties were revealed. Consequently, the actor remains unattributed beyond the personal details provided.

The August 2020 incident represents the only publicly reported operation linked to this alias, involving the alleged hacking of UK PayPal accounts and the subsequent seizure of personal electronics. Law enforcement released the suspect under investigation after the initial arrest, and no subsequent public updates have been issued. This case stands as the sole documented example of the actor’s activity in open sources.