Scammers just posted 1.3 million payment card numbers on Joker's Stash, a market for ID theft

It's the latest evidence Indian cardholders' data is being marketed for identity theft.

A database containing roughly 1.3 million credit and debit card numbers belonging primarily to Indian bank customers was uploaded this week to Joker’s Stash, an online market specializing in stolen personal data, according to new findings by security researchers.

Group-IB, in a statement e-mailed Tuesday to CyberScoop, said the database was uploaded Oct. 28, and is worth more than $130 million, the equivalent value of roughly one dollar per record. Ninety-eight percent of the files belong to Indian banks, while 1% originate with a Colombian entity. Group-IB did not name any of the banks affected, victims included in the database or speculate on who may have uploaded the information.

This addition of credit card information came just days after researchers determined that Joker’s Stash is growing. Over its four-year lifespan, the illicit card shop has become a dumping ground for financial information stolen from organizations like Hy-Vee, Sonic Drive-In and others. Now, it’s also a place where scammers also are selling Social Security numbers belonging to high-profile victims, including members of the Trump administration, according to Recorded Future research released last week.

Group-IB’s findings provide the latest proof that Joker’s Stash has emerged as a leading marketplace for identity thieves.

It’s hardly the first time digital thieves have tried to make a buck with Indian cardholders’ data. Underground forums listed 3.2 million records of stolen Indian card data last year, a 219% uptick from 2017, the threat intelligence firm Gemini Advisory previously told CyberScoop. That number was enough to put India in third place among all countries in the world when it comes to the number of records for sale on the dark web, following the U.S. and U.K.

Many financial breaches go unreported in India, resulting in banks being slow to stop stolen cards from being used for fraud, Gemini researchers said. As a result, the Reserve Bank of India has required banks to release ATM cards that rely on EMV chips, which provide more security in transactions where a buyer is physically present. The measure is less useful for securing online transactions.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Attackers exploit zero-days in consistently besieged SonicWall product

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure