A California man has been indicted for stealing Shopify customer data with the help of two company employees. According to the indictment and reporting from TechCrunch, Tassilo Heinrich paid Shopify support team members to illicitly access data from merchants who used the payment processing platform. The employees sent screenshots or Google Drive links with customers’ names, addresses, purchase histories, and other personal information. Heinrich allegedly resold that data to fraudsters and used it to set up copycat merchant pages.

Heinrich is charged with identity theft and conspiracy to commit wire fraud; his two co-conspirators, based in Portugal and the Philippines, were not charged. Shopify didn’t immediately respond to a request for comment.

Shopify acknowledged last year that two “rogue members” of its support team had breached customers’ security. It said the incident affected fewer than 200 merchants and emphasized that the breach stemmed from employees abusing their access rather than a technical vulnerability. The BBC reported that one of the merchants was Kylie Jenner’s makeup company Kylie Cosmetics.