A collection of approximately 400,000 payment card records, mainly from South Korea and the United States, has emerged on the dark web this month, Group-IB reports.
Uploaded on a popular darknet cardshop on April 9, this collection represents the largest sale of South Korean records on underground markets this year, the cyber-security company warns. It also shows the growing popularity of APAC-issued card dumps among cyber-criminals.
The total number of records in the database is 397,365, and the dump has a total price of $1,985,835, at $5 per record. The dump has a 30-40% validity rate, infamous underground marketplace Joker’s Stash announced.
The database mainly contains Track 2 information, such as bank identification number (BIN), account number, and expiration date, and may include the card verification value (CVV) as well. Such data is usually harvested from infected POS terminals, ATM skimmers, or breached payment systems.
While the provenance of the data is still unknown, Group-IB discovered that 49.9% of the records in it were from South Korea (198,233 items valued at $991,165). Furthermore, 49.3% of the items were related to banks and financial organizations in the United States.
“While American card dumps have traditionally been most commonly traded in the dark web, the South Korean payment card details are a very rare commodity in the underground. The newly released database marks the biggest sale for South Korean card dumps in 2020,” Group-IB notes.
The security firm points out that the frequency at which APAC-issued card dumps are being offered for sale on the dark web has increased over the past few years. In fact, such dumps are currently the second most popular on underground markets, surpassed only by US-issued card dumps. Prices for APAC-issued cards are dropping due to high supply, making them more available.
Group-IB says it has already notified national CERTs and financial organizations in South Korea and the United States, so that the appropriate steps to mitigate the risks could be taken.
“Even though, there is not enough information in this dump to make online purchases, fraudsters who buy this data can still cash out stolen records. If a breach is not detected promptly by the card-issuing authority, crooks usually produce cloned cards („white plastic“) and swiftly withdraw money via ATMs or use cloned cards for illicit in-person purchases,” Shawn Tay, senior threat intelligence analyst at Group-IB, commented.
Related: Credit Card Skimmer Found on Tupperware Website