US prosecutors have charged two men with conspiracy and fraud after they allegedly breached the computer systems of Denver-based Photobucket and sold passwords and access to private information on the giant photo-sharing website.
Brandon Bourret, 39, of Colorado, and Athanasios Andrianakis, 26, of California, were arrested at their homes, the US Department of Justice said in a statement.
The two allegedly developed and sold a software application that allowed users to circumvent the privacy settings on Photobucket, which describes itself as the world's leading dedicated photo and video-sharing service.
Application users could then covertly access and copy password-protected information and images without authorisation from Photobucket's users, according to the statement.
"It is not safe to hide behind your computer, breach corporate servers and line your own pockets by victimising those who have a right to protected privacy on the internet," US Attorney John Walsh for the District of Colorado said in the statement.
Founded in 2003, Photobucket says it has more than 100 million registered users.
Bourret and Andrianakis both face one count of conspiracy, which carries a penalty of up to five years in federal prison and a fine of up to US$250,000 (A$315,000).
They also each face one count of computer fraud, which carries the same maximum penalty, and two counts of access device fraud, which carries a fine of up to US$250,000 and maximum federal prison sentence of 10 years per count.