Security News > 2021 > April > Hacker sells $38M worth of gift cards from thousands of shops
A Russian hacker has sold on a top-tier underground forum close to 900,000 gift cards with a total value estimated at $38 million.
The database contained cards from thousands of brands and may originate from an older breach at the now-defunct discount gift card shop Cardpool.
The seller did not disclose how they got the cache but claimed that it included 895,000 gift cards from 3,010 companies, including Airbnb, Amazon, American Airlines, Chipotle, Dunkin Donuts, Marriott, Nike, Subway, Target, and Walmart.
Threat intelligence firm Gemini Advisory says that gift cards typically sell for 10% of their value.
A day after selling the gift cards, the same actor offered to sell incomplete data from 330,000 debit cards in an auction that started at $5,000 and a buy-now price of $15,000.
With the store accepting card payments and both databases sold by the same actor, it is logical to assume that it is also the source for the gift cards.