Kosovo man pleads guilty to running online marketplace for stolen personal data

Ardit Kutleshi, 28, a Kosovar national, pleaded guilty in federal court in Pennsylvania to charges tied to his creation and operation of Rydox, an online marketplace where cybercriminals bought and sold stolen personal information and tools for carrying out fraud, the Justice Department announced.

Kutleshi pleaded guilty in the U.S. District Court for the Western District of Pennsylvania to aggravated identity theft and money laundering conspiracy. He is scheduled to be sentenced Feb. 9, 2027. According to the department, the aggravated identity theft count carries a mandatory minimum of two years in prison, while the money laundering conspiracy count carries a maximum of 20 years. A federal district court judge will determine the sentence after considering the U.S. Sentencing Guidelines and other statutory factors.

According to court documents, Rydox conducted more than 7,600 transactions since at least 2016 involving stolen personally identifiable information, stolen access devices, means of identification and cybercrime tools and services. The site took in at least $232,000 in revenue, and the stolen data included information taken from victims in the United States, the department said.

People were interested in these podcasts

U.S. Attorney Troy Rivetti of the Western District of Pennsylvania said Kutleshi and his brother, Jetmir, operated the marketplace for their own gain and made hundreds of thousands of dollars from it. Jetmir Kutleshi pleaded guilty and was sentenced in December 2025 before being deported to Kosovo, Rivetti said. He added that such crimes cause financial loss as well as lasting psychological harm to victims, who lose trust in institutions and online marketplaces.

Assistant Attorney General A. Tysen Duva of the Justice Department’s Criminal Division said the plea shows the department will pursue cybercriminals wherever they are in the world through international cooperation and technical expertise.

FBI Cyber Division Assistant Director Brett Leatherman said Rydox offered the stolen identities and logins of thousands of people. He said the FBI and its foreign partners shut the marketplace down and vowed to keep using every legal tool to extradite cybercriminals and dismantle their infrastructure.

Kosovo law enforcement arrested Kutleshi in December 2024, and he was extradited from Kosovo to the United States in 2025. In December 2024, the United States also judicially seized the domain www.Rydox.cc, which hosted the marketplace, preventing its owners and third parties from continuing to use it to trade stolen personal information and cybercrime tools, according to the department.

The FBI’s Pittsburgh Field Office investigated the case in coordination with the Kosovo State Prosecutor’s Special Prosecution Office and the Kosovo Police’s Cybercrime Investigation Directorate. Other partners were Albania’s Special Anti-Corruption Body, the Royal Malaysia Police’s Commercial Crime Investigation Department and the Attorney General’s Chambers of Malaysia.

Advertisement Advertisement

Senior Counsel Thomas Dougherty of the Criminal Division’s Computer Crime and Intellectual Property Section and Assistant U.S. Attorney Nicole Stockey for the Western District of Pennsylvania are prosecuting the case. The department’s Office of International Affairs also assisted.

This article was constructed with the assistance of artificial intelligence and published by a member of The Washington Times' AI News Desk team. The contents of this report are based solely on The Washington Times' original reporting, wire services, and/or other sources cited within the report. For more information, please read our AI policy or contact Steve Fink, Director of Artificial Intelligence, at sfink@washingtontimes.com

The Washington Times AI Ethics Newsroom Committee can be reached at aispotlight@washingtontimes.com.