Jakarta. A group of teenagers and one 27-year-old hacked into Tiket.com — one of the largest online travel agents in Indonesia — and siphoned Rp 4.1 billion ($308,000) worth of airline tickets from the website, the National Police said in Jakarta on Tuesday (04/04).

The alleged perpetrators were identified only by their initials. SH, who is 19-years-old and identified by the police as the mastermind of the crime, admitted that he made around Rp 600 million in proceeds from the act.

His partner, MKU, also 19-years-old, admitted to making Rp 600 million. Two other alleged perpetrators have also been identified: AI, 19 and NTM, 27.

SH admitted to using the loot to buy expensive motorcycles.

"I bought a Ducati motorcycle [...]. None of the money was used for investment [purposes]," SH said at the National Police headquarters on Tuesday.

The police said they may face up to 12 years in prison under Indonesia's Law on Electronic Information and Transactions (ITE) revised in 2013.

Global Network, the company behind Tiket.com, reported the case to the police in November when it suspected someone hacked into Tiket.com and stole tickets allotted for the budget airline Citilink Indonesia.

Airlines usually set aside a ticket quota for each travel agent, and are usually paid for the tickets in advance. In this case, the teenagers hacked into the website and accessed Citilink's ticket pool.

"The perpetrators had illegal access to Citilink Indonesia's server, using an account owned by Global Network from Oct. 11 to 27, 2016," Brig. Gen. Fadil Imran, the director of cyber crime at National Police's Criminal Investigation Unit (Bareskrim) said on Tuesday.

The perpetrators then sold the stolen tickets on Facebook, Fadil added.

MKU, AI and NTM were arrested on March, 28 in Balikpapan, East Kalimantan. The police nabbed SH in Ciputat, Banten two days later.

The case shed light on security issues on Indonesia's booming online services industry.

"He [SH] is quite sophisticated and the website was also not that hard to hack," Adj. Comr. Idam Wasiadi of the cyber crime unit at Bareskrim said last week.

Idam said SH, who only finished middle school, taught himself using materials available online to hack into various websites.

He honed his skill by hacking into 4,237 foreign and local websites and defacing their homepage. Among his victims are the National Police's website and app-based ride-hailing service Go-Jek, Idam added.

Citilink Indonesia, a low-cost subsidiary of Garuda Indonesia, said that the integrity of its ticket security and customer's information was not compromised by the hackers and the breach was only limited to the online agent, Tiket.com, Ageng W. Leksono, corporate communication manager of Citilink told news outlet detik.com.