Two men were arrested and indicted on Friday for their alleged role in hacking Photobucket, an image and video-hosting website. The two are accused of selling illegal access to accounts on the website.

Brandon Bourret, 39, of Colorado Springs and Athanasios Andrianakis, 26, of Sunnyvale, California, were arrested and brought in for questioning regarding the alleged conspiracy, according to the Department of Justice. More specifically, the duo are accused of developing and selling PhotoF---et, software that enabled users to bypass privacy settings of the Photobucket website and gain unauthorized access to private photos and passwords of its users.

“Unauthorized access into a secure computer system is a serious federal crime,” said FBI Denver Special Agent in Charge Thomas Ravenelle in a statement. “The arrest of Brandon Bourret and his co-conspirator reflects the FBI’s commitment to investigate those who undertake activities such as this with the intent to harm a company and its customers.”

The investigation into which Photobucket accounts were accessed is ongoing.

If convicted, the duo faces charges that include one count of conspiracy and one count of computer fraud, aiding and abettting. Both charges carry a penalty of up to a five-year prison term and fines of up to $250,000. They also face two counts of access device fraud, which carries a penalty of up to 10 years in prison and up to a $250,000 fine per count.

“The U.S. Attorney’s Office is keenly focused on prosecuting those people for their theft -- and for the wanton harm they do to innocent internet users,” said U.S. attorney John Walsh in a statement.