The risk is no longer just stolen card numbers. A free release that bundles full PANs, CVV2, expiry, and PII gives fraud crews one dataset for card-not-present abuse, account takeovers, and targeted social engineering.
SOCRadar validated samples from B1ack’s Stash and says the dump contains 4.6 million stolen credit-card records, with about 4.3 million appearing new and usable. The records include cardholder names, billing addresses, email addresses, phone numbers, and IP addresses, and most appear to come from the US, with Canada, the UK, France, and Malaysia also heavily represented.
The bigger shift is distribution. By making the inventory free after accusing sellers of reselling it elsewhere, B1ack’s Stash turned a controlled underground listing into broadly accessible fraud material, raising the hit rate for both payment fraud and identity validation abuse.