Connect with us

Hi, what are you looking for?



Collection of South Korean, U.S. Payment Cards Emerges on Underground Market

A collection of approximately 400,000 payment card records, mainly from South Korea and the United States, has emerged on the dark web this month, Group-IB reports.

A collection of approximately 400,000 payment card records, mainly from South Korea and the United States, has emerged on the dark web this month, Group-IB reports.

Uploaded on a popular darknet cardshop on April 9, this collection represents the largest sale of South Korean records on underground markets this year, the cyber-security company warns. It also shows the growing popularity of APAC-issued card dumps among cyber-criminals.

The total number of records in the database is 397,365, and the dump has a total price of $1,985,835, at $5 per record. The dump has a 30-40% validity rate, infamous underground marketplace Joker’s Stash announced.

The database mainly contains Track 2 information, such as bank identification number (BIN), account number, and expiration date, and may include the card verification value (CVV) as well. Such data is usually harvested from infected POS terminals, ATM skimmers, or breached payment systems.

While the provenance of the data is still unknown, Group-IB discovered that 49.9% of the records in it were from South Korea (198,233 items valued at $991,165). Furthermore, 49.3% of the items were related to banks and financial organizations in the United States.

“While American card dumps have traditionally been most commonly traded in the dark web, the South Korean payment card details are a very rare commodity in the underground. The newly released database marks the biggest sale for South Korean card dumps in 2020,” Group-IB notes.

The security firm points out that the frequency at which APAC-issued card dumps are being offered for sale on the dark web has increased over the past few years. In fact, such dumps are currently the second most popular on underground markets, surpassed only by US-issued card dumps. Prices for APAC-issued cards are dropping due to high supply, making them more available.

Advertisement. Scroll to continue reading.

Group-IB says it has already notified national CERTs and financial organizations in South Korea and the United States, so that the appropriate steps to mitigate the risks could be taken.

“Even though, there is not enough information in this dump to make online purchases, fraudsters who buy this data can still cash out stolen records. If a breach is not detected promptly by the card-issuing authority, crooks usually produce cloned cards („white plastic“) and swiftly withdraw money via ATMs or use cloned cards for illicit in-person purchases,” Shawn Tay, senior threat intelligence analyst at Group-IB, commented.

Related: Credit Card Skimmer Found on Tupperware Website

Related: Over 70 Rutter’s Stores Hit by Payment Card Breach

Related: Landry’s Discloses Payment Card Incident

Written By

Ionut Arghire is an international correspondent for SecurityWeek.

Click to comment

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

SecurityWeek’s Threat Detection and Incident Response Summit brings together security practitioners from around the world to share war stories on breaches, APT attacks and threat intelligence.


Securityweek’s CISO Forum will address issues and challenges that are top of mind for today’s security leaders and what the future looks like as chief defenders of the enterprise.


Expert Insights

Related Content


The changing nature of what we still generally call ransomware will continue through 2023, driven by three primary conditions.


Luxury retailer Neiman Marcus Group informed some customers last week that their online accounts had been breached by hackers.


As it evolves, web3 will contain and increase all the security issues of web2 – and perhaps add a few more.


A recently disclosed vBulletin vulnerability, which had a zero-day status for roughly two days last week, was exploited in a hacker attack targeting the...


Satellite TV giant Dish Network confirmed that a recent outage was the result of a cyberattack and admitted that data was stolen.


Zendesk is informing customers about a data breach that started with an SMS phishing campaign targeting the company’s employees.

Artificial Intelligence

The release of OpenAI’s ChatGPT in late 2022 has demonstrated the potential of AI for both good and bad.

Artificial Intelligence

The degree of danger that may be introduced when adversaries start to use AI as an effective weapon of attack rather than a tool...