SECURITYWEEK reports that the dark web carding marketplace B1ack’s Stash announced a free download of 4.6 million stolen credit card records, released after sellers were caught reselling data purchased from the site on other platforms. The data dump reportedly includes full card numbers, expiration dates, CVV2 codes, cardholder names, billing addresses, email addresses, phone numbers and IP addresses, with SOCRadar estimating that around 4.3 million records are new and likely usable for illicit activity.
According to SOCRadar, the stolen cards come from worldwide sources, with about 70% originating in the US, and the dataset also features entries from Canada, the UK, France and Malaysia. The site had previously suspended 8 million stolen CVV2 records in response to sellers’ misconduct, and it opted to release the data rather than delete it from inventory.
The release follows B1ack’s Stash’s history on the dark web since at least 2023, with earlier actions including a 1 million-card offer in April 2024 and a 4 million-card free release in February 2025, according to SecurityWeek.