ABOUT three weeks ago, Cheryl Lambert bought a £179 surfboard on eBay for her daughter. Soon after, she noticed her computer started to behave erratically and within a few days it had ground to a halt.

“It just completely crashed,” said Lambert, 38, a community worker who lives in Helston, Cornwall. “The anti-virus software was saying the computer was infected, but it just couldn’t fight it. The computer got slower and slower and then it just stopped.”

A few days after her desktop machine was unplugged from the internet, Lambert’s personal details appeared on a Russian website.

Her home phone number, her address, her credit card number and her e-mail address with Tesco were all listed on a forum where criminals and computer hackers trade stolen identities. Lambert cancelled her gold Lloyds TSB card when she was alerted by The Sunday Times to what had happened, but one fraudulent transaction for £10.70 had already been made.

Lambert is believed to have fallen victim to malicious “trojan” software. This can be unwittingly downloaded from an e-mail attachment or website and then quietly records details of passwords, security codes and credit card numbers used on secure websites. The information is relayed back to the author of the malicious software.

The Russian website that posted Lambert’s details, www.carder.info, is one of a network of sites which trade in stolen identities. Thousands of passwords for e-mail accounts, security numbers for credit cards and access codes for shopping websites are offered for sale online after being “harvested” from trojan software.

In a four-week investigation a Sunday Times reporter approached users on Russian websites who were offering stolen identities for sale. The site includes a step-by-step guide to stealing identities and using the information without detection.

The reporter was offered stolen data on British citizens ranging in price from $2 to $5 per person. She requested a free sample and at 11.50pm on August 23 the details of more than 30 individuals were posted online, 13 of whom were British.

Max Haffenden, 27, an IT worker from Bexhill-on-Sea in East Sussex, was among those on the list and he confirmed last week that The Sunday Times had obtained his secret password from the Russian website. He uses the password — which has now been cancelled — for his personal Yahoo! e-mail account, payment transfers using PayPal and online shopping accounts.

“I am amazed someone could have got access to these details,” he said. “I have a good idea of how computers work and how to be as secure as possible. I only trust a site with my details if it has a ‘padlock’ to show it is a secure server.”

Haffenden, who used a computer firewall and anti-virus software, said his computer’s systems alerted him to malicious software, which he said might have been a trojan, about a year ago. He was unable to fix the problem but said it did not affect the performance of his computer.

Others on the list said there had been no apparent problems with their machines. Nick Riches, 40, from Basingstoke in Hampshire, who also works in the computer industry, was among those targeted. He confirmed his “standard secure password” had been obtained by the Russian website, along with his Hotmail access, his home address and details of a NatWest card. He said he regularly scanned his computer for viruses but had not been aware of any malicious software.

There was evidence last week that the fraudsters had already used some of the personal data to steal money. Cards belonging to Haffenden and Riches had been used without their permission on an internet gambling site, Unibet, in the past month with payments of £400 and £512.50.

Explore UK News

• Crime News

• Education News

• Health News

• Scotland News

Times Recommends

• Wartime couple are reunited 68 years on
• 50 People of the Decade
• Book round-ups. Turkeys tarted up. I feel sick