15-year-old Merseyside boy

Profile narrative

The threat actor known publicly as the 15‑year‑old Merseyside boy is a juvenile individual residing in the United Kingdom. According to a TEISS report published on 26 August 2020, Merseyside Police arrested the teenager and subsequently released him under investigation for allegedly compromising multiple PayPal accounts based in the UK earlier that year. The arrest was carried out by the force’s Cyber Dependent Crime Unit in collaboration with the Matrix team. A search of the suspect’s residence was conducted as part of the investigation, and the operation resulted in the seizure of numerous personal items.

Among the seized goods were an iPhone 11, iPhone 8, Apple Watch, Samsung phone, Apple AirPods, an iPad, a Sony mobile phone and a mini motorbike, which the report described as expensive gadgets. The article explicitly states that the unauthorized access to PayPal accounts was accompanied by the seizure of items that suggest potential financial gain from the activity. Consequently, the targeted sector is identified as the financial services industry, specifically the PayPal payment platform, with the geographic focus limited to the United Kingdom. No technical details such as malware families, initial access vectors or specific tooling have been disclosed in the public reporting.

To date the only publicly reported operation linked to this alias is the August 2020 PayPal account compromise incident; no additional campaigns or broader criminal consortium affiliations have been identified. Consequently, the actor’s profile remains confined to the single event described, with no evidence of state sponsorship, ongoing operations, or larger scale activity. The information available stops at the arrest, the seizure of devices and the allegation of unlawful access to UK‑based PayPal accounts. No further updates on legal proceedings or subsequent activity have been made available in open sources.

Incidents

Attributed incidents are available to members.