WeLeak Info Leaked Customer Payment Info
Summary: A lapsed domain tied to WeLeakInfo, a service the FBI and overseas partners seized in January 2020 after it sold access to more than 12 billion stolen usernames and passwords, was re-registered by a Raidforums user known as "pompompurin," who used it to reset the Stripe account password and publish payment data on roughly 24,000 customers. Flashpoint said the leaked data includes partial credit card data, email addresses, full names, IP addresses, browser user agent strings, physical addresses, phone numbers, and amounts paid, covering only customers who checked out via Stripe.
What you should know: The exposure traces to a single expired domain the FBI did not renew, which let one person reset a payment processor account and pull the transaction history for nearly 24,000 paying customers - a reminder that abandoned domains and third-party payment accounts outlive the takedown.
Read the original at Krebs on Security ↗
- Topics
- Cybercrime & Law Enforcement
- Related
- Gootloader Malware Disrupted After Infecting 25,000 Computers Cyber Risks · Nov 13, 2026354 dark web vendors and buyers arrested in Operation Tor Nado Cyber Risks · Nov 13, 2026Law Enforcement Disrupts Gootloader, CastleRAT, and StealC Infrastructure Cyber Risks · Nov 13, 2026