Vendor of Stolen Bank Cards Hacked
Summary: A fraud shop called mn0g0.su, launched in January 2011 to sell stolen card data by bank issuer, victim ZIP code and card type, was found backing up its database unencrypted to a wide-open third-party server. The exposed backup held more than 81,000 sets of credit and debit card numbers with expiration dates and security codes, plus cardholder names, addresses and phone numbers, and the email addresses, IP addresses, ICQ numbers, usernames and passwords of more than 4,300 of the shop's own customers.
Bottom line: The shop's customer passwords were salted-SHA256 hashed while the card data sat in plaintext, and the backup was still being written to the open server after the exposure was found - so more than 81,000 cardholders' full details, including Social Security numbers and mothers' maiden names for some, remain exposed with no sign the leak has been closed.
Read the original at Krebs on Security ↗
- Topics
- Data Breaches
- Related
- TSMC employee data breach linked to cloud provider Cyber Risks · Nov 15, 2026Data Breach at La Poste Subsidiary Maileva Affects 22 Million People in France Cyber Risks · Nov 15, 2026City of Osaka warns of data breach impacting 1 million as Japan reels from dozens of cyber incidents Cyber Risks · Nov 13, 2026