The men used an online application to bombard the victim’s web domain with thousands of attempts to log in to customer accounts