A Threat Actor is Allegedly Selling 15,000+ Fullz from the USA

Quick Facts

📅 Date: 2025-01-21
🚨 Title: Alleged Sale of Fullz Data from the USA
🛡️ Victim Country: USA
🏭 Victim Industry: N/A
🏢 Victim Organization: N/A
🌐 Victim Site: N/A
📜 Category: Data Leak
🔗 Claim: https://forum.exploit.in/topic/253069/
🕵️‍♂️ Threat Actor: upshop33
🌍 Network: Openweb

WhiteIntel.io Data Leak Information

(No victim site disclosed)

Description

The threat actor "upshop33" has posted a listing on an underground forum offering 15,828 PDFs of allegedly stolen fullz data from the USA. According to the post, the dataset includes:

• Social Security Numbers (SSNs): Available in text format.
• Driver’s License Photos: Front-side images are included.
• Photos of SSNs: Some records include scanned SSN cards.

The dataset is listed for auction with the following details:

• Starting Price: $1,500.
• Incremental Bidding Step: $50.
• Blitz Price: $15,000.
• End of Bidding: 48 hours after the last bid.

The seller claims the source is active and offers guarantees, though access to the original source is not included in the price. The seller also notes that some driver’s licenses may have expired.

Compromised Data

The dataset allegedly includes:

• Social Security Numbers (SSNs) in plain text.
• Driver’s license photos.
• Photos of SSN cards.

Implications

For Individuals in the Dataset:

1. Identity Theft Risk: Exposure of SSNs, driver’s licenses, and other sensitive information significantly increases the risk of financial fraud and identity theft.
2. Phishing and Fraudulent Activities: Threat actors may use the information for targeted scams or impersonation.

For Organizations:

1. Regulatory Violations: Organizations linked to the exposed data may face legal scrutiny.
2. Reputational Damage: Any business implicated in this breach could face customer distrust and negative media attention.

Recommendations

For Affected Individuals:

1. Monitor Credit Activity: Regularly check credit reports for unauthorized transactions or inquiries.
2. Freeze Credit: Consider placing a credit freeze with major bureaus to prevent fraudulent accounts.
3. Enable Alerts: Set up fraud alerts with financial institutions to detect unauthorized activities.

For Organizations:

1. Investigate the Source: Determine if the data breach originated from their systems.
2. Enhance Data Security: Implement robust encryption and access controls for sensitive information.
3. Notify Affected Parties: Inform individuals whose data may have been compromised, per legal requirements.