1.3 Million Debit Cards Go Up for Sale in Biggest Ever Dark Web Bank Data Dump

In a massive data dump, 1.3 million credit and debit cards have been listed for sale on Joker's Stash, the internet's biggest online card shop. ZDNet reports that the October 28 dump is one of the rarest and largest in recent history. Cybersecurity Company Group-IB is struggling to learn exactly where Joker's Stash obtained all the card information, while noting that the data being sold is rarely seen in this type of database.

This affects mostly Indian cardholders. Group-IB CEO and founder Ilya Sachkov wrote, "The cards from this region are very rare on underground markets, in the past 12 months it is the only big sale of card dumps related to Indian banks." ZDNet reports that most of the cards are being sold for $100. Joker's Stash has a long history as one of the dark web's oldest and biggest online card shops. The Singapore cybersecurity company has valued the dump at more than $130 million.

ZDNet reports that what sets these card dumps apart from this on is that all the details were released at once instead of in small batches, as the sales from earlier this year were. Sachkov also stated, "The databases are usually uploaded in several smaller parts and at different times." He went on to call it, "The biggest card database encapsulated in a single file ever uploaded on underground markets at once." He also noted that the card sales "hadn't been promoted prior either in the news, on card shop or even on forums on the dark net."

India Credit Card hack
A recent card dump on Joker's Stash has listed 1.3 million Indian cardholder's details for sale in what experts are calling "the biggest data dump" in history. Chandan Khanna/AFP/Getty

Analysts have shared their thoughts that card details were obtained from skimming ATMs and PoS systems. The data on Joker's Stash comes from information stored in a card's magnetic stripe, making it impossible that the cards were compromised from internet skimming. The diversity of the banks that the cards belong to indicate that the dump is not the result of one bank getting hacked, ZDnet reports.

While the size of this card dump is unique, details of credit and debit cards being sold on the dark web is not a new phenomenon. ZDNet reports in February that 2.15 million Americans' cards were dumped on the site. Details from 5.3 million Hy-Vee customers were dumped onto Joker's Stash in August, and the information of about a million South Korean cardholders was sold on the site between June and July.

Group-IB reports that the proper authorities have been notified.