Pay Ivy Sells Your Online Accounts Via PayPal
Summary: PayIvy, an open web marketplace run by a Hackforums user named Sh1eld, was selling stolen credentials for Netflix, Hulu, Spotify, DirecTV, HBO Go, and gaming accounts at Origin, Steam, PlayStation and Xbox Live, along with Adobe and Microsoft license keys, and accepted PayPal as payment. Krebs found sellers in five minutes of searching who were accepting PayPal through PayIvy for hijacked PayPal accounts themselves, and PayPal associate general counsel Jack Christin Jr. said the site itself does not violate its Acceptable Use Policy, though PayPal has exited merchants selling goods that do.
Key Takeaway: Stolen credentials for major consumer services were priced at a dollar apiece and bought with PayPal, meaning a buyer could pay for a hacked account using a stolen credit card or a stolen PayPal account, and the marketplace stayed open because the payment processor judged the site itself compliant.
Read the original at Krebs on Security ↗
- Topics
- Data Breaches
- Related
- TSMC employee data breach linked to cloud provider Cyber Risks · Nov 15, 2026Data Breach at La Poste Subsidiary Maileva Affects 22 Million People in France Cyber Risks · Nov 15, 2026City of Osaka warns of data breach impacting 1 million as Japan reels from dozens of cyber incidents Cyber Risks · Nov 13, 2026