CloudSEK’s contextual AI digital risk platform discovered a threat actor advertising a database of 1.2 Million cards for free on a Russian speaking cybercrime forum. This followed a previous incident of 7.9 million cardholder data advertised on the BidenCash website. Unlike previous records, this time they released sensitive Personal Identifiable Information (PII) information such as SSN, card details, and CVV.
State Bank of India, Fiserv Solutions LLC, American Express were some of the top banking institutions which were affected. There were approximately 508000 Debit cards breached with 414000 records of Visa payment network followed by Mastercard. The majority of personal emails associated with the card details were exposed. Other official emails records were found to be exposed associated with SoftBank, Bank of Singapore, and World bank from the previous data breach by BidenCash.
Rishika Desai, Cyber Threat Researcher- CloudSEK said, ”Marketplaces like BidenCash emerge frequently where the threat actors trade sensitive card data for carding and cloning services. While the modern day security mechanisms are able to minimize the impact, threat actors regularly check deploy new methods to bypass them. On a personal level, trying to track your card transactions, being aware of malicious sites luring off a great deal can help prevent to a greater extent. With the BidenCash group trying to gain popularity through various measures, leaking card data motivates other groups to follow the same steps.”
The motivation behind these data leaks was to gain more traffic to their website and establish a reputation. BidenCash forum became active in early february 2022. Post that the threat actor resorted to various ways to gain traffic to his website such as spamming comments on websites. The first website to emerge was bidencash[.]com in the year 2020, after which most of the series of domains were registered with different TLDs in the year 2022, with the recent one being bidencash[.]group.
Before Bidencash, another carding forum named “All world cards” released 1 billion stolen cards in the year 2018 – 2019. The threat has been active on underground forums that trade carding information such as Blackbones, Crdpro, and Club2CRD.
The leaked PII could enable threat actors to orchestrate social engineering schemes, phishing attacks, and even identity theft. Exposed card details might be used by them to carry out attacks such as card trafficking, card cloning, and unauthenticated transactions to facilitate illegal purchases.
Using virtual cards offered by certain banks that enable users to simply revoke them or single-use cards that are automatically erased after a single purchase can protect consumers against such data breaches. Another option is to implement multi-factor authentication and monitor account anomalies on a regular basis.
