The US Justice Department said on 24 September 2026 (US time) that Kosovar national Ardit Kutleshi, 28, pleaded guilty in the District Court for the Western District of Pennsylvania to aggravated identity theft and money laundering conspiracy over his creation and operation of Rydox, an illicit website and marketplace where cybercriminals bought, sold and traded stolen personal information, access devices and other cybercrime tools.

According to court documents cited by the department, since at least 2016 Rydox conducted over 7,600 transactions involving stolen personally identifiable information, stolen access devices, means of identification and cybercrime tools and services, receiving at least US$232,000 in revenue, with the PII stolen from victims in the United States. Kutleshi was arrested by Kosovo law enforcement in December 2024, when the US also seized the Rydox.cc domain, and was extradited to the United States in 2025.

He is due to be sentenced on 9 February 2027 and faces a mandatory minimum of two years in prison for aggravated identity theft and up to 20 years for money laundering conspiracy.

US Attorney Troy Rivetti said Kutleshi's brother Jetmir pleaded guilty and was sentenced in December 2025, before his deportation to Kosovo. The FBI's Pittsburgh Field Office investigated with authorities in Kosovo, Albania and Malaysia, and FBI Cyber Division Assistant Director Brett Leatherman is quoted on the takedown. BleepingComputer (25 September) adds that Rydox offered over 321,000 other cybercrime products to more than 18,000 users, that a third administrator, Shpend Sokoli, was also arrested in December 2024, and that the marketplace's servers in Kuala Lumpur were seized with the help of the Royal Malaysian Police.

Primary: US Justice Department; wire: BleepingComputer.

Correction (25 Oct 2026): the Justice Department's release is now readable and the card rests on it and on BleepingComputer; a judge's name and a 'time served' sentence for Jetmir Kutleshi, which neither source gives, have been removed. (source: US Justice Department)