Hacking group Lizard Squad made a name for itself with high-profile attacks on Sony and Microsoft’s online gaming networks. Now the group appears to have been hacked itself, as it tried to profit from its fame by selling a service to take other websites down.

The group unveiled LizardStresser at the end of 2014, after its Christmas attacks on PlayStation Network and Xbox Live which took both offline over the holiday period.

It charged between $6 and $500 in the bitcoin cryptocurrency to help people launch distributed denial of service (DDoS) attacks on any website or internet service they chose.

Since then, online security researcher Brian Krebs has claimed that the service was using a network of “hacked home routers” to launch its attacks. Now he says that the site’s security was less than effective at protecting its own customers’ private information.

“A copy of the LizardStresser customer database obtained by KrebsOnSecurity shows that it attracted more than 14,241 registered users, but only a few hundred appear to have funded accounts at the service,” wrote Krebs in a blog post claiming that LizardStresser had been hacked.

“Interestingly, all registered usernames and passwords were stored in plain text. Also, the database indicates that customers of the service deposited more than USD $11,000 worth of bitcoins to pay for attacks on thousands of Internet addresses and Web sites (including this one).”

The news follows several arrests made as police investigate the original PlayStation Network and Xbox Live attacks.

On 31 December, a 22 year-old man from Twickenham was arrested by the South East Regional Organised Crime Unit (SEROCU) on suspicion of fraud by false representation and Computer Misuse Act offences, before being released on bail until 10 March.

Then, on 16 January, an 18 year-old man was arrested in Southport on suspicion of unauthorised access to computer material, unauthorised access with intent to commit further offences, and threats to kill.

The latter refer to incidents of “swatting” where US police were called out to what they believed was a major incident after what SEROCU described as “hoax calls via Skype”. The 18 year-old man has also been released on bail.

• How you could become a victim of cybercrime in 2015

