Well, the non-article on nextweb references the Register one, here it is, just in case: http://www.theregister.co.uk/2017/01/17/police_warn_of_dutch_developer_

Well, the non-article on nextweb references the Register one, here it is, just in case: http://www.theregister.co.uk/2017/01/17/police_warn_of_dutch_developer_who_built_backdoors_for_carding/ http://www.theregister.co.uk/2017/01/17/police_warn_of_dutch... It talks of "Various companies used him to build sites with web shop functionality," so very likely it is just a few companies 10-30 with 500-2000 users each that total 20,000 credentials stolen.