ZDNet, referring to information received from Group-IB, reported that data on bank cards of 463,378 clients of Turkish banks appeared on sale on the Joker’s Stash carding resource.
For the first time, two parts of a dump called TURKEY-MIX, which included data from 60,000 bank cards, were discovered by researchers on October 28, 2019, and later, on November 27, 2019, two more parts of this database for 400,000 cards were published on the same resource. The database contains information about the validity period of the cards, CVV / CVC, the name of the card holder, as well as some additional information, such an email address, name and phone numbers.
It is reported that more than 99% of the cards from this dump belong to Turkish banks, which is very interesting, since usually Turkish cards are rarely found on the black market. So, over the past year, this is the only major “sale” of payment cards associated with Turkish banks. According to Group-IB experts, the value of the base on the black market is estimated at $ 500,000.
The dump contains both debit and credit cards, which come from a variety of Turkish banks. A wide variety of types of cards and issuing banks suggests that the data was obtained from a source that processes payments, and not by hacking into any bank’s systems. Also, the presence of email addresses and phone numbers in the dump excludes the possibility that the information was received using skimmers installed on ATMs or PoS devices.
According to Group-IB analysts, this data could be collected in different ways: they could be “leaked” by the users themselves by entering information on phishing pages; the malware could steal this data from the browsers of the victims; Web-skimmers could be used to steal data in hacked online stores (we are talking about Magecart attacks).
This is the second major leak this year related to Joker’s Stash. Let me remind you that in October Group-IB analysts noticed the appearance of a huge database on the carder resource that contained more than 1.3 million credit and debit card entries, mainly owned by customers of Indian banks. Information about each card in this set is estimated at $ 100, that is, the total cost of the database is approximately $ 130 million.