Joker's Stash claims 3 million cards stolen from Dickey's Barbecue

The incident underscores how scammers target chokepoints for sensitive data — and how they continue to turn to Joker’s Stash to try to sell it off.

Joker’s Stash, one of the most notorious web forums for stolen credit card data, has claimed a new scalp.

Sellers on the site this week claimed to be offering 3 million payment card numbers used at Dickey’s Barbecue Pit, a U.S. restaurant chain, researchers at intelligence firm Gemini Advisory said Thursday. More than 100 of the barbecue joint’s locations were affected by the breach, and the data is being sold for a median price of $17 per card, according to the research.

The data from Dickey’s Barbecue Pit customers appears to have been compromised between July 2019 and August 2020, according to Gemini Advisory. Numerous restaurant and hospitality chains have been hit by scammers in recent years because of the personal financial data they collect.

“Given the widespread nature of the breach, the exposure may be linked to a breach of the single central processor, which was leveraged by over a quarter of all Dickey’s locations,” Gemini said in a blog post.

“We received a report indicating that a payment card security incident may have occurred,” Dickey’s Barbecue Pit said in a statement. “We are taking this incident very seriously and immediately initiated our response protocol and an investigation is underway. We are currently focused on determining the locations affected and time frames involved.”

The incident underscores how scammers target chokepoints for sensitive data, and then turn to illicit markets like the Joker’s Stash to try to sell it off. The site only is the latest in a generation of black market communities where users from around the world promise access to goods ranging from narcotics, hacking tools and child pornography. Such markets consistently have attracted attention from international law enforcement, only for competitors to fill gaps that emerge after police takedowns.

“Joker’s Stash remains one of the most active, persistent, and affluent cybercriminals of our time,” Gemini Advisory CEO Andrei Barysevich said in an email. “In the past year alone, we estimate that this actor’s operations earned Joker and their accomplices close to half a billion dollars.”

Barysevich said the forum has “one of the most respected brands” on the internet’s underbelly. Branding and reputation matter heavily in the digital underground, where scammers rely on word-of-mouth to determine which vendors are trustworthy.

Joker’s Stash is a case study in how criminals have in recent years expanded the types of data they steal and try to commoditize. Having established a reputation as a go-to place for selling card data, Joker’s Stash denizens have gone further to advertise a range of personal information, such as Social Security numbers.

This isn’t the first major security incident that Dickey’sBarbecue Pit has had to face. The restaurant chain was hit by a CryptoLocker ransomware attack in 2015. The company rebuilt some of its networks instead of paying a $6,000 ransom, according to D Magazine.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Technology

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

• The Collective Cyber Defense letter wrote your next vendor questionnaire

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure