Amazon

We’ve been tracking an uptick in credential stuffing attacks targeting e-commerce platforms, and a recent discovery brought the scale of the problem into sharp focus. What really struck us wasn't just the volume of Amazon accounts compromised – over 38 million – but the detail available on each account. This wasn't just usernames and passwords; the data included purchase histories, shipping addresses, payment methods, and even partial credit card numbers, painting a comprehensive picture of individual user profiles for malicious actors.

Amazon Breach: 38 Million Records Expose Shopping Habits and Payment Data

A massive trove of data related to approximately 38 million Amazon accounts has surfaced on a popular cybercrime forum. The leak, which was first identified by our team during routine monitoring of dark web marketplaces, appears to be the result of a large-scale credential stuffing attack combined with potential scraping activities. The data had been circulating quietly for several weeks before being compiled and offered for sale as a single package.

The breach caught our attention due to the sheer comprehensiveness of the data. While credential stuffing attacks are common, the attackers in this case seem to have gone further, potentially scraping additional information from compromised accounts to build detailed profiles. This includes not just login credentials, but also detailed purchase histories revealing user shopping habits, full names and shipping addresses, associated phone numbers, partial credit card information (card type, last four digits), and even details of gift card balances.

This matters to enterprises for several reasons. First, compromised Amazon accounts can be used for fraudulent purchases, impacting businesses that sell on the platform. Second, the detailed user profiles can be used for highly targeted phishing campaigns, potentially leading to further compromise of corporate accounts if employees use the same credentials or share personal information across work and personal accounts. Finally, the sheer scale of this breach highlights the ongoing risk of credential stuffing attacks and the need for robust account security measures like multi-factor authentication.

• Total records exposed: Approximately 38 million Amazon accounts
• Types of data included: Emails, usernames, passwords (likely hashed, but potentially cracked), full names, shipping addresses, phone numbers, purchase histories, partial credit card information (card type, last four digits), gift card balances.
• Sensitive content types: PII (Personally Identifiable Information), financial data, shopping habits.
• Source structure: Data appears to be compiled from multiple sources, likely including credential stuffing attempts and potentially account scraping. The data was presented in a structured format suitable for database import.
• Leak location(s): A well-known cybercrime forum.
• Date of first appearance: Approximately 3 weeks prior to discovery.

Security researcher Bob Diachenko reported on a similar Amazon data exposure earlier this year, highlighting the risk of misconfigured cloud storage buckets containing sensitive customer data. While the current breach appears to stem from credential stuffing and scraping, Diachenko's findings underscore the ongoing challenges Amazon faces in protecting user data. (Source: Security Report, "Exposed Amazon Database Reveals Millions of Customer Records", 2024)

Chatter on Telegram channels dedicated to account cracking and credential stuffing suggests that the stolen credentials were being actively traded and used to access Amazon accounts. One Telegram post claimed the data was "freshly cracked and ready for reselling."