1.3 Million Bank Card Records Listed for Sale on Joker’s Stash

Group-IB experts have reported that a massive database containing over 1.3 million credit and debit card records, mostly belonging to customers of Indian banks, was recently uploaded to the well-known carding platform Joker’s Stash. This is not only one of the largest databases ever dumped on the black market, but possibly one of the most expensive as well. Each card record in the set is valued at $100, making the total worth of the database approximately $130 million.

The dump was published under the name “INDIA-MIX-NEW-01” and has been for sale since October 28, 2019. The database contains copies of the magnetic stripes of credit and debit cards, specifically Track 2 data, although the full name of the dump indicates it includes both Track 1 and Track 2 records. Researchers note that Track 2 dumps can be used to create cloned cards for further cash withdrawals.

According to the company, more than 98% of the records in the database belong to Indian banks, with another 1% linked to Colombian banks. Over 18% of the data is associated with a single unnamed Indian bank. It appears that most of the card information was stolen either through skimmers installed on ATMs or via malware targeting PoS terminals. Interestingly, the presence of both Track 1 and Track 2 data suggests that web skimmers like Magecart were not involved in this breach.

Expert Commentary

“It’s true that large payment data leaks have happened before; however, databases are usually uploaded in several smaller parts and at different times. This is truly the largest card database encapsulated in a single file ever uploaded to underground markets at once. What’s interesting in this particular case is that the database for sale was not previously advertised in the news, in card shops, or even on dark web forums. Cards from this region are very rare on underground markets; in the past 12 months, this is the only major sale of card dumps related to Indian banks. Group-IB Threat Intelligence clients have already been notified about the sale of this database. The information has also been passed on to the relevant authorities,” said Ilya Sachkov, head and founder of Group-IB.