NewsPublished 19 May 2026

B1ack’s Stash Marketplace Gives Away 4.6 Million Stolen Credit Cards

Source SecurityWeek

Description

The stolen credit card data was released as a free download, allegedly in response to seller misconduct. The post B1ack’s Stash Marketplace Gives Away 4.6 Million Stolen Credit Cards appeared first on SecurityWeek .

Impact

The impact includes increased risk of card-not-present fraud, fraudulent online purchases, identity theft, and phishing attacks due to the availability of full card details and associated personal information. The richness of the data allows attackers to perform more convincing social engineering and financial fraud. Approximately 4.3 million of the records are new and likely usable for illicit activities. The breach affects a global set of victims, predominantly in the US, but also in Canada, the UK, France, Malaysia, and other countries. There is no direct remediation for this data leak, and the threat persists as long as the data circulates in criminal communities.

Defensive guidance

Organizations should monitor for fraudulent transactions and consider enhanced fraud detection measures. Affected individuals should be advised to monitor their financial statements and consider credit monitoring or freezes. Financial institutions and payment processors should continue to apply existing fraud prevention controls and collaborate with law enforcement. No direct remediation from the vendor or marketplace is possible.

Summary

B1ack’s Stash, a dark web carding marketplace active since at least 2023, publicly released 4.6 million stolen credit card records for free download. This release followed the suspension of 8 million stolen CVV2 records after sellers violated marketplace policies by reselling data on competing platforms. The leaked dataset contains comprehensive payment and personal information, validated in part by cybersecurity firm SOCRadar, and is sourced globally with a majority from the US. The data likely stems from multiple phishing and e-skimming operations. The release is expected to facilitate card-not-present fraud, fraudulent account creation, and phishing attacks. This event represents a significant compromise of payment card data but is not a software vulnerability and thus does not have a patch or fix.

References

securityweek.com/b1acks-stash-marketplace-gives-away-4-6-million-stolen-credit-cards/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 19 May 2026, 12:06 UTC

References

Community reviews