Loading story…
Rapid7 identified an active identity-as-a-service market in which cybercriminals sell compromised Social Security number (SSN) records tied to corporate executives for as little as $0.25. Since early 2026, researchers tracked 476 exposed SSN records associated with 395 unique corporate personnel, with C-suite leaders and company presidents accounting for most of the affected individuals.
Three services—Xilo, Bankomat, and PeopleFinder—accounted for 81.5% of identified executive SSN leaks, functioning as clearinghouses for data originating from aggregators, healthcare and financial-sector breaches, infostealer infections, and phishing. The records can enable synthetic-identity and tax fraud, executive impersonation, and business email compromise; organizations should continuously monitor executive identity exposure, prepare response processes, and apply stronger verification controls for high-risk financial and identity-related requests.
See attribution, scope, and your downstream exposure.
4 events from the most recent confirmed update back to the earliest known activity.
Since early 2026, Rapid7 tracked 476 compromised SSN records associated with 395 corporate personnel. C-suite executives and corporate presidents comprised most affected profiles, and Xilo, Bankomat, and PeopleFinder accounted for 81.5% of identified leaks.
Xilo began operating in March 2025 as a Tor hidden service with clear-web mirrors, offering SSN records at a flat price of $0.25 and reverse lookups for $0.50.
PeopleFinder began operating as a direct successor to SSNDOB Marketplace, which had been seized in June 2022. It reportedly reused SSNDOB's database of more than 24 million U.S. personally identifiable-information records and retained SSNDOB branding in its front-end source code.
Bankomat began operating as a marketplace for stolen payment-card data, CVVs, validation tools, and SSN records. It charges $4 per SSN record.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
3 references tracked. Mallory keeps watching after this page renders.
cyberveille.ch
Open sourcecybersecuritynews.com
Open sourcerapid7.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A newly launched dark-web identity-theft service, **Nexus**, is offering scans of more than 153 million U.S. and Canadian driver’s licenses alongside millions of other identity documents. The operators claim to have continuously exfiltrated records from a major identity-verification provider for more than a year, and its inventory reportedly increased by nearly 400,000 license records within 24 hours. The listings include front-and-back document scans, including infrared and ultraviolet image formats. Victim accounts and image timestamp correlations tied records to identity checks at travel locations, car-rental agencies, and marijuana dispensaries, pointing to Louisiana-based identity-verification provider **idscan.net** as a possible source; the attribution has not been conclusively confirmed. The FBI’s New Orleans field office opened an investigation into the apparent compromise, while idscan.net said it was investigating without providing substantive public details. The exposure creates risks of identity and new-account fraud, biometric misuse, stalking, and physical harm, particularly for government personnel and people seeking to protect their identity or location.
Sep 7, 2026
National Public Data disclosed a security incident affecting a large repository of consumer background-check and people-search information, with exposed data reported to include highly sensitive personal identifiers such as **Social Security numbers**, names, mailing addresses, and other profile details. The company published a breach notice on its website, while an individual notification letter filed with the California Attorney General indicates affected residents were formally notified that their information may have been involved. The incident drew attention because the compromised records appear to involve data commonly used for identity verification and fraud, increasing the risk of **identity theft**, account takeover, and social-engineering abuse. The notification materials show the breach response included direct notice to impacted individuals and guidance on protective steps such as monitoring accounts and credit activity, underscoring the seriousness of the exposure for consumers whose records were held by the data broker.
Jul 12, 2026
A Russian-operated darknet marketplace, run by the group Karma Fullz, is trafficking in the identities of former U.S. visa holders who have since left the country. These synthetic identities, which include Social Security numbers, clean credit histories, and tax records, are being sold on a Telegram-based platform that exploits gaps in U.S. tracking of departed visa holders. The marketplace offers three tiers of identity packages, with the most valuable being aged ex-patriot identities priced at over $1,000 due to their rich credit histories and higher fraud success rates. Fraudsters are using these identities to open new bank accounts, apply for credit cards, claim fraudulent tax refunds, and access public benefits, all while appearing as legitimate users within U.S. financial systems. Financial institutions often fail to detect these reactivated identities due to a lack of effective monitoring for such activity, according to experts at SentiLink. The operation highlights a significant vulnerability in U.S. fraud risk management and underscores the need for improved detection mechanisms for synthetic identity fraud.
Jun 29, 2026