One of the largest markets for stolen banking data on the dark web is back in the spotlight of the international cybersecurity community. The platform B1ack's Stash announced the free distribution of approximately 4.6 million credit card records, in a move that raises concerns about a potential wave of financial fraud and phishing attacks worldwide.
According to information released by security researchers, the leak did not come from a government operation or a cyberattack on the platform, but was an internal "punishment" for sellers who violated the marketplace's operating rules. B1ack's Stash management accused certain partners of reselling card data to competing forums and dark web marketplaces, violating internal exclusivity policies.
The case reveals once again that illegal data markets now operate with structures reminiscent of regular businesses, with rules, cooperation policies, and "penalty" mechanisms for those who violate agreements.
See also: Microsoft reveals Storm-2949 attack on Azure Cloud and Microsoft 365
B1ack's Stash: Free distribution of millions of banking data
In response to the data leak from partner vendors, B1ack's Stash reportedly "froze" around 8 million CVV2 files and then decided to make much of its inventory public for free rather than deleting it. This move is considered particularly dangerous, as it gives access to lower-level cybercriminals who until now could not afford to purchase such expensive databases.
Cybersecurity firm SOCRadar, which analyzed some of the leaks, confirmed that the datasets include full payment card details, such as credit card numbers, expiration dates, CVV2, cardholder details, billing addresses, emails, phone numbers, and IP addresses.
Researchers estimate that the data was obtained mainly through e-skimming attacks and phishing campaigns. In the first case, attackers intervene in online stores and steal payment details in real time. In the second, users are deceived through fake emails, websites or SMS that imitate banks and well-known services.
Millions of active cards remain usable
While some of the records appear to be expired or duplicate cards, SOCRadar says that around 4.3 million records remain active and potentially exploitable for illegal activity. This means that millions of users worldwide could be facing unauthorized charges, financial fraud , or even attempted identity theft.
The majority of the cards originate from the United States, which accounts for around 70% of the listings. However, a significant number of victims are also found in countries such as Canada, the United Kingdom, France and Malaysia.
See also: 7-Eleven data breach: ShinyHunters behind the attack?
Experts point out that the geographical dispersion of the data indicates that this is not a single eavesdropping operation, but a combination of multiple phishing and skimming campaigns that targeted markets with high consumer activity and increased use of electronic payments.
The dark web is evolving into a complete ecosystem of financial crime
B1ack's Stash has been operating since at least 2023 and is considered one of the most active banking data trading platforms on the dark web. The market has repeatedly concerned authorities and security researchers due to massive card data leaks and aggressive promotions.
In April 2024, the platform offered free access to about a million cards for new users, while in early 2025 it carried out another major leak of millions of files. These moves appear to be used as a marketing strategy on the dark web, aiming to attract new partners and customers.
Cybersecurity analysts warn that such databases primarily fuel card-not-present (CNP) fraud, i.e. purchases made online without the physical presence of the card. At the same time, the additional personal data can be used to open fake accounts, submit credit applications or conduct targeted social engineering attacks.
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
The risks go beyond simple financial fraud
Experts emphasize that combining financial and personal information in a single entry creates an extremely dangerous environment for users. When attackers have a card number, CVV2, billing address, email, phone and IP address, they gain the ability to create particularly convincing fraud scenarios.
In many cases, such data is used for targeted phishing attacks that look completely authentic, as the criminals already know the victims' personal information. This significantly increases the chances of the attacks being successful and makes them harder for users to detect.
See also: INTERPOL: Operation Ramz disrupts cybercrime networks
The new massive leak is a reminder that protecting financial data no longer depends solely on banks or payment institutions. E-commerce businesses themselves, but also consumers, are called upon to invest more in security mechanisms, multi-factor authentication and constant monitoring of suspicious transactions, as organized cybercrime continues to evolve at a rapid pace.
