B1ack’s Stash Marketplace Gives Away 4.6 Million Stolen Credit Cards

Summary

The B1ack's Stash dark web carding marketplace has publicly released 4.6 million stolen credit card records, allegedly in response to sellers reselling card data on competing platforms. The leaked dataset includes full card numbers, expiration dates, CVV2 codes, cardholder names, billing addresses, emails, phone numbers, and IP addresses, with approximately 70% of cards originating from the US. SOCRadar estimates 4.3 million records are new and usable for fraud, with the release expected to fuel card-not-present fraud and account takeover attacks.

Full text

The notorious B1ack’s Stash dark web carding marketplace has announced the free download of 4.6 million stolen credit card records. The data, it says, was dumped after sellers were caught reselling card data purchased from B1ack’s Stash on competing platforms, a violation of the marketplace’s policies. B1ack’s Stash allegedly suspended 8 million stolen CVV2 records in response to the sellers’ misconduct, and decided to release the card data for free, instead of deleting it from its inventory. According to SOCRadar, the released data includes full card numbers, expiration dates, CVV2 codes, cardholder names, billing addresses, email addresses, phone numbers, and IP addresses. Based on the availability of full card details and payment data, the information was likely stolen as part of e-skimming or phishing operations, SOCRadar says. The cybersecurity firm says it has validated the authenticity of some of the records. Analysis of the data showed that some of the cards had expired or were duplicate entries.Advertisement. Scroll to continue reading. Overall, 4.3 million records appear to be new and likely usable for illicit activities, SOCRadar says. The stolen credit cards are sourced worldwide, but approximately 70% of them are from the US. Canada, the UK, France, and Malaysia round out the top five. “The presence of Asian financial hubs like Hong Kong, Singapore, Thailand, and Malaysia in the top 15 suggests the dataset is not solely the product of a single regional operation, but draws from multiple skimming or phishing campaigns targeting English-speaking and high-purchasing-power markets globally,” SOCRadar notes. B1ack’s Stash has been operating on the dark web since at least 2023, becoming one of the most active shops for stolen credit card data. In April 2024, the marketplace offered 1 million credit cards to anyone who registered. In February 2025, it released over 4 million stolen credit cards for free, likely to attract more users. The newly dumped cards are expected to fuel card-not-present (CNP) fraud activities, such as illicit online purchases. The accompanying information may allow cybercriminals to open fraudulent accounts, apply for credit, or launch convincing phishing attacks. “The richness of the leaked records – full PAN, CVV2, expiration date, billing address, full name, email, phone, and IP address in a single entry – creates compounding risks that go well beyond simple card fraud,” SOCRadar says. Related: Chilean Carding Shop Operator Extradited to US Related: Carding Marketplace BidenCash Shut Down by Authorities Related: US Announces Charges, Sanctions Against Russian Administrator of Carding Website Related: Underground Carding Marketplace Joker’s Stash Announces Shutdown Written By Ionut Arghire Ionut Arghire is an international correspondent for SecurityWeek. Daily Briefing Newsletter Subscribe to the SecurityWeek Email Briefing for the latest cybersecurity threats, trends, and expert insights. More from Ionut Arghire Admins of Bulletproof Hosting Service Used by Russian Hackers Arrested in Netherlands266,000 Affected by Data Breach at Radiology Associates of RichmondLaravel-Lang Packages Poisoned for Malware DeliveryDocketWise Data Breach Impacts 143,000Over 5,500 GitHub Repositories Infected in ‘Megalodon’ Supply Chain Attack‘Underminr’ Vulnerability Lets Attackers Hide Malicious Connections Behind Trusted DomainsGrafana Says Codebase and Other Data Stolen via TanStack Supply Chain AttackCisco Patches Critical Vulnerability in Secure Workload Latest News AppOmni’s Marlin AI Brings Autonomous Investigation to SaaS SecurityIranian APT Targets Aviation, Software Companies With Updated Tools185,000 Likely Impacted by 7-Eleven Data BreachAnthropic Expands Claude’s Enterprise Security Governance With 28 New IntegrationsHackers Exploited KnowledgeDeliver Zero-Day for Web Shell DeploymentWatch on Demand: Threat Detection & Incident Response Summit – All Sessions AvailableOpen Source DockSec Uses AI to Cut Through Vulnerability Noise in Docker ImagesLithuania Suspects Foreign Involvement in Data Leak of Over 600,000 National Register Entries Trending Daily Briefing NewsletterSubscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts. Virtual Event: Threat Detection and Incident Response Summit On-Demand Delve into big-picture strategies to reduce attack surfaces, improve patch management, conduct post-incident forensics, and tools and tricks needed in a modern organization. Register Webinar: Third-Party Risk in Practice June 4, 2026 Organizations are investing heavily in third-party risk management, but breaches, delays, and blind spots continue to persist. Join this live webinar as we examine the gap between how organizations think their third-party risk programs are performing and what’s actually happening in practice. Register People on the MoveJoe Chen has become Chief Technology Officer at Trellix.Usercentrics has named Pawan Hegde as COO and Elena Ignatova as CPTO.SecureAuth has named Mark van Oppen as Chief Revenue Officer.More People On The MoveExpert Insights Caught Off Guard: Securing AI After It Hits Production As enterprises rush AI projects into production, security teams are increasingly being forced into reactive mode. (Joshua Goldfarb) Cyber Resilience is the New Business Continuity Plan The organizations best prepared to face disruption are those that align security, continuity and risk management around what the business cannot afford to lose. (Steve Durbin) Enhancing Data Center Security Without Sacrificing Performance For AI data centers, where the stakes are the highest and performance constraints are the tightest, security and performance are no longer a zero-sum game. (Nadir Izrael) Is the SOC Obsolete, and We Just Haven’t Admitted It Yet? Many AI-first enterprises have already embraced sovereign architectures for general AI initiatives; cybersecurity—and the SOC—should be next. (Danelle Au) The Mythos Moment: Enterprises Must Fight Agents with Agents Only with the right platform and an agentic, AI-driven defense, will enterprises be able to protect themselves in the agentic era. (Etay Maor) Flipboard Reddit Whatsapp Whatsapp Email

Indicators of Compromise

• malware — B1ack's Stash

Entities