Largest underground store “BriansClub,” for buying stolen credit cards got hacked, over 26 million credit and debit card data extracted from the underground store.
BriansClub found to be sold more than 9.1 million stolen credit cards and the store earned more $126 million according to the KrebsOnSecurity report.
Brian Kerbs also complains that the website is using his popularity and even his image on their ads to carry out their activities.
The plain text data that contains payment card data shared to KrebsOnSecurity, the data includes the one available for sale at BriansClub[.]at and the historical data.
Multiple analysis of the payment card data reveals that the same card data has been shared with multiple sources and anyone can BriansClub Web site account can retrieve the data.
The exposed data contains credit card data starting from 2015 to 2019.
- 2015 BriansClub added 1.7 million cards
- 2016 BrainsClud added 2.89 million cards
- 2017 Around 4.9 million cards
- 2018 holds 9.2 million cards
- Between January and August 2019 7.6 million cards
The data offered by the BriansClub are mostly dumps, which contains ones and zeros when these data are written in the magnetic stripe, they are used by criminals for making payments.
The below table shows the market value of the cards in dark markets.
According to Flashpoint analysis, the BriansClub holds more than $414 worth of stolen credit card details. Out of 26M stolen cards, around 14M cards found valid and not expired.
Cyber-security journalist Brian Kerbs has contacted the BriansClub through a support ticket and they acknowledged that “the data center was hacked and the data affected by the data-center breach has been since taken off sales, so no worries about the issuing banks.”
The stolen credit card data form BriansClub is shared with financial institutions to identify and monitor or reissue cards listed on the black market website.
The stolen card details also showed when they were uploaded to BriansClub. The site started with 1.7 million card records for sale before adding 2.89 million stolen cards in 2016, 4.9 million cards in 2017 and 9.2 million in 2018.
Between January and August this year, August being the month the hack took place, about 7.6 million cards were added. The value of the stolen cards is estimated to be $414 million.
The owner of BriansClub, who claims to be Brian Krebs himself and even uses the security researcher’s likeness, confirmed the theft with the real Krebs, saying that the organization’s data center was hacked and that information affected by the breach has since been taken down.
“The theft ultimately has little impact on credit card owners, since all of the cards were going to be used for fraud, anyway,” Paul Bischoff, privacy advocate with research firm Comparitech Ltd. told SiliconANGLE.
“It’s interesting to note that Krebs thinks the supply of stolen cards for sale on BriansClub outstrips demand.
There are literally more stolen credit cards up for sale than criminals know what to do with.”
The number of stolen cards hosted by BriansClub was also noted by Deepak Patel, security evangelist for bot protection firm PerimeterX Inc., who said that the BriansClub breach is a reminder of the sheer volume of stolen card data available online.
“It’s important for retailers to keep an eye out for the common signs of carding attacks such as low-cost purchases — used to verify the stolen cards — followed by large purchases using the same card,” he said.
Ilia Kolochenko, founder and chief executive of web security company ImmuniWeb, noted that the incident proves cybercriminals are not immune from being hacked themselves.
“Sadly, most of these ‘internal’ incidents further exacerbate the situation for the victims who will likely find their personally identifiable information or stolen cards being exposed even to bigger number of unauthorized third parties,” Kolochenko said.
“The presumed value for law enforcement agencies, when the data about illicit traders becomes public, is likewise questionable given that most of the readers know how to use chained VPNs and proxies.”