Breach Disclosure: Carding Mafia

The carding forum, Carding Mafia, experienced a data breach around 03/17/2021. In a post by user 'HansoN' on Raidforums, they shared the breach, however, the user 'DuckSquad' claimed responsibility and shared a link to a paste site containing more details. According to the DuckSquad posting, there are around 500,000 users details included in the breach, while HansoN said around 290,000 lines.

Recommendations

Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account

Details

In the posting on Raidforums by HansoN, they share the contents of the SQL database acquired from Carding Mafia, which includes the following fields:

INSERT INTO user (userid, usergroupid, membergroupids, displaygroupid, username, password, passworddate, email, styleid, parentemail, homepage, icq, aim, yahoo, msn, skype, showvbcode, showbirthday, usertitle, customtitle, joindate, daysprune, lastvisit, lastactivity, lastpost, lastpostid, posts, reputation, reputationlevelid, timezoneoffset, pmpopup, avatarid, avatarrevision, profilepicrevision, sigpicrevision, options, birthday, birthday_search, maxposts, startofweek, ipaddress, referrerid, languageid, emailstamp, threadedmode, autosubscribe, pmtotal, pmunread, salt, ipoints, infractions, warnings, infractiongroupids, infractiongroupid, adminoptions, profilevisits, friendcount, friendreqcount, vmunreadcount, vmmoderatedcount, socgroupinvitecount, socgroupreqcount, pcunreadcount, pcmoderatedcount, gmmoderatedcount, assetposthash, fbuserid, fbjoindate, fbname, logintype, fbaccesstoken, bloggroupreqcount, showblogcss, vbseo_likes_in, vbseo_likes_out, vbseo_likes_unread, dbtech_vbshout_banned, dbtech_vbshout_settings, dbtech_vbshout_shouts, dbtech_vbshout_shoutstyle, dbtech_vbshout_silenced, dbtech_vbshout_shoutarea, dbtech_vbshout_pm, dbtech_vbshout_soundsettings, dbtech_vbshout_shoutboxsize, dbtech_vbshout_shoutboxsize_detached, dbtech_vbshout_displayorder, dbtech_vbshout_shouts_lifetime, newrepcount, dbtech_registration_invites_sent_total, dbtech_registration_invites_sent, panjo_selling, showvsastats, rmEmailDate, rmEmailCount, rmoptout) VALUES

To note, there are a large number of sensitive fields, including social media profiles, IP addresses, usernames and passwords, and birthday.

Figure 1: Breach posting on Raidforums