Hacker posts data of 10,000 American Express accounts for free

A threat actor has posted data of 10,000 American Express credit card holders on a hacker forum for free.

In the same forum post, the actor claims to sell even more data of Mexican banking customers of American Express, Santander, and Banamex.

Data exposes credit card numbers and customers’ PII

This week a threat actor leaked data of 10,000 Mexico-based American Express credit cardholders on a forum.

The finding was brought to light by threat intelligence analyst, Bank Security.

As analyzed by BleepingComputer, the leaked sample data set of 10,000 records exposes full American Express account (credit card) numbers and customers’ personally identifiable information (PII) including name, full address, phone numbers, date of birth, gender, etc.

However, BleepingComputer did not see credit card expiration dates, passwords, or overly sensitive financial data in the posted spreadsheet that could enable misuse of the credit cards in fraudulent transactions.

It seems the actor behind the forum post intends to expose this data mainly for marketing spam purposes.

“I do not sell private data such as password, card information, id number. With the data I sell or share, you are only exposed to spam or marketing :),” stated the seller in the same forum thread. 

Amex aware and monitoring the situation

BleepingComputer reached out to American Express to verify the authenticity of the leaked information.

American Express neither denied nor admitted that they had suffered a data breach, but shared that all Amex cardholders are not liable for fraudulent charges.

“We are aware of the report and are closely monitoring the situation. We do not have anything further to share at this time.”

“However, as a reminder, American Express Card Members are not liable for any fraudulent charges on their accounts. American Express has sophisticated monitoring systems and internal safeguards in place to help detect fraudulent and suspect activity. If we see there is unusual activity which may be fraud, we will take protective actions,” American Express told BleepingComputer in a statement.

Amex cardholders should remain vigilant and report any fraudulent activity seen on their card statements to American Express.

Additionally, cardholders are urged to watch out for suspicious phishing emails, texts, and phone calls which could now be even harder to spot—if the scammers include parts of the credit card number and legitimate PII in these communications to earn the customer’s trust.

Source: https://www.bleepingcomputer.com/news/security/hacker-posts-data-of-10-000-american-express-accounts-for-free/?&web_view=true