A collection of approximately 400,000 payment card records, mainly from South Korea and the United States, has emerged on the dark web this month, Group-IB reports.
Uploaded on a popular darknet cardshop on April 9, this collection represents the largest sale of South Korean records on underground markets this year, the cyber-security company warns. It also shows the growing popularity of APAC-issued card dumps among cyber-criminals.
The total number of records in the database is 397,365, and the dump has a total price of $1,985,835, at $5 per record. The dump has a 30-40% validity rate, infamous underground marketplace Joker’s Stash announced.
The database mainly contains Track 2 information, such as bank identification number (BIN), account number, and expiration date, and may include the card verification value (CVV) as well. Such data is usually harvested from infected POS terminals, ATM skimmers, or breached payment systems.
While the provenance of the data is still unknown, Group-IB discovered that 49.9% of the records in it were from South Korea (198,233 items valued at $991,165). Furthermore, 49.3% of the items were related to banks and financial organizations in the United States.
“While American card dumps have traditionally been most commonly traded in the dark web, the South Korean payment card details are a very rare commodity in the underground. The newly released database marks the biggest sale for South Korean card dumps in 2020,” Group-IB notes.
The security firm points out that the frequency at which APAC-issued card dumps are being offered for sale on the dark web has increased over the past few years. In fact, such dumps are currently the second most popular on underground markets, surpassed only by US-issued card dumps. Prices for APAC-issued cards are dropping due to high supply, making them more available.
Group-IB says it has already notified national CERTs and financial organizations in South Korea and the United States, so that the appropriate steps to mitigate the risks could be taken.
“Even though, there is not enough information in this dump to make online purchases, fraudsters who buy this data can still cash out stolen records. If a breach is not detected promptly by the card-issuing authority, crooks usually produce cloned cards („white plastic“) and swiftly withdraw money via ATMs or use cloned cards for illicit in-person purchases,” Shawn Tay, senior threat intelligence analyst at Group-IB, commented.
Related: Credit Card Skimmer Found on Tupperware Website
Related: Over 70 Rutter’s Stores Hit by Payment Card Breach
Related: Landry’s Discloses Payment Card Incident
More from Ionut Arghire
- Blackpoint Raises $190 Million to Help MSPs Combat Cyber Threats
- ‘Asylum Ambuscade’ Group Hit Thousands in Cybercrime, Espionage Campaigns
- Google Cloud Now Offering $1 Million Cryptomining Protection
- Pharmaceutical Giant Eisai Takes Systems Offline Following Ransomware Attack
- North Korean Hackers Blamed for $35 Million Atomic Wallet Crypto Theft
- Cisco Patches Critical Vulnerability in Enterprise Collaboration Solutions
- Android’s June 2023 Security Update Patches Exploited Arm GPU Vulnerability
- US, Israel Provide Guidance on Securing Remote Access Software
Latest News
- In Other News: AI Regulation, Layoffs, US Aerospace Attacks, Post-Quantum Encryption
- Blackpoint Raises $190 Million to Help MSPs Combat Cyber Threats
- Google Introduces SAIF, a Framework for Secure AI Development and Use
- ‘Asylum Ambuscade’ Group Hit Thousands in Cybercrime, Espionage Campaigns
- Evidence Suggests Ransomware Group Knew About MOVEit Zero-Day Since 2021
- SaaS Ransomware Attack Hit Sharepoint Online Without Using a Compromised Endpoint
- Google Cloud Now Offering $1 Million Cryptomining Protection
- Democrats and Republicans Are Skeptical of US Spying Practices, an AP-NORC Poll Finds
