BriansClub Explained: The 2019 Carding Marketplace Breach and Its Impact

BriansClub was an underground marketplace associated with the sale of stolen payment card information. The name became widely known after a 2019 breach exposed data connected to more than 26 million stolen credit and debit cards. The incident gave researchers an unusual view of how a large carding operation worked and showed why stolen payment data can remain useful to criminals even after banks introduce stronger card security.

This guide explains what BriansClub was, how its business model worked at a high level, what the 2019 breach revealed, why the stolen data mattered, and what consumers and businesses can learn from the incident.

What Was BriansClub?

BriansClub was a criminal marketplace focused on stolen payment card information. Unlike a conventional online store, the platform operated as part of the underground cybercrime economy.

The marketplace listed card records obtained through different forms of theft. Researchers found that much of the inventory came from magnetic stripe data collected during in-person transactions. Other records involved card-not-present fraud, which relates to transactions where the physical card is not required.

The name BriansClub also created confusion because the operation used the identity and images of journalist Brian Krebs in its advertising. Krebs has repeatedly reported on the marketplace and its activities. 

The platform became an important case study because researchers eventually obtained a large portion of its underlying data.

How the BriansClub Business Model Worked

BriansClub did not need to steal every card itself.

Research indicates that the marketplace largely acted as a reseller. Other criminals supplied stolen card information, while the marketplace provided a place where buyers could obtain the data. Sellers and the marketplace shared revenue from transactions. 

That model matters because cybercrime often works through specialization. One group steals information. Another group packages and sells it. A third group attempts fraudulent transactions.

The marketplace therefore functioned as an intermediary within a larger criminal supply chain.

The NYU research team found that BriansClub listed more than 19 million unique card numbers between 2015 and 2019 and generated close to $104 million in gross revenue during that period. The research estimated around $24 million in profit over four years.

These figures help explain why stolen payment information became an organized business rather than a collection of isolated attacks.

The 2019 BriansClub Breach

The most important event in BriansClub’s history occurred in 2019.

Someone breached the marketplace and obtained more than 26 million stolen payment card records. The information was later provided to KrebsOnSecurity and then shared with financial institutions. Those institutions could use the information to identify compromised cards and take steps such as monitoring or replacing them. 

The size of the dataset was enormous.

KrebsOnSecurity reported that the 26 million records represented roughly one-third of the 87 million payment card accounts being sold across underground shops at that time.

The breach produced an unusual outcome. Data originally stolen for criminal purposes became useful to banks and security researchers because defenders could study the information and identify exposed accounts.

What Information Was Exposed?

The compromised dataset involved payment card information. Reports describe records containing details such as:

• Credit and debit card numbers
• Expiration information
• Cardholder names
• Billing information
• Card verification information in some records

The exact contents varied between records. The important point is that the dataset contained information that could support payment fraud. 

The data did not represent a new breach of every person whose information appeared in the database. BriansClub was primarily a marketplace for information stolen elsewhere. The 2019 incident exposed the marketplace’s collection of already stolen data.

That distinction is important when discussing the event.

What Researchers Learned From BriansClub

The leaked marketplace data gave researchers a rare opportunity to study a criminal card market using actual transaction records.

A team from NYU Tandon School of Engineering examined the data from 2015 through 2019. Their research found more than 19 million unique card numbers listed for sale and close to $104 million in gross revenue. 

One finding stood out.

Around 97% of BriansClub’s inventory came from magnetic stripe data captured during in-person transactions. Yet buyers purchased only about 40% of that inventory.

Card-not-present records showed a different pattern. Buyers purchased about 83% of that inventory.

This suggests that criminals did not treat every stolen card record as equally useful. Demand depended on factors such as the issuing bank, transaction environment, and the defenses protecting the account.

The researchers also found that roughly 60% of listed accounts did not attract buyers, even though some records sold for very low prices.

That finding challenges the idea that every stolen card number automatically becomes useful to a criminal.

Why Chip Cards Did Not Eliminate the Problem

EMV chip cards reduced certain forms of counterfeit card fraud, but the BriansClub research showed that the magnetic stripe still created a weakness.

Researchers found that 85% of the stolen magnetic stripe data in the final two years of the dataset came from cards that had EMV chips. 

The reason is straightforward. A card can contain a secure chip and still have a magnetic stripe. When a transaction uses the stripe instead of the chip, information can be exposed through skimming or other forms of theft.

The study therefore showed that installing chips was only one part of payment security. How merchants and customers process transactions also matters.

Why BriansClub Became Such an Important Cybersecurity Case

BriansClub offers several lessons about modern payment fraud.

First, stolen information can move through multiple criminal groups before reaching an end user.

Second, criminals assign different prices and levels of demand to different types of stolen data.

Third, security improvements can change criminal behavior rather than eliminate fraud altogether.

Fourth, defenders can sometimes use information recovered from criminal infrastructure to protect victims.

The BriansClub dataset helped banks identify cards that were circulating in the underground market. That allowed financial institutions to monitor accounts and replace exposed cards before some fraudulent activity occurred.

Who Was Affected by BriansClub?

The direct victims were people and organizations whose payment information had been stolen and later appeared in the marketplace.

There were also wider effects.

For consumers, compromised card information can lead to unauthorized purchases, account disruption, and time spent resolving fraudulent activity.

For merchants, payment card theft can lead to fraud costs, investigations, security expenses, and reputational damage.

For banks, large datasets of compromised cards create additional work involving fraud detection, customer support, card replacement, and monitoring.

This makes a carding marketplace a problem that extends well beyond the criminals who operate the site.

How Can You Tell If Your Information Was Exposed?

The 2019 BriansClub incident does not provide a simple public list that tells every person whether their specific payment card appeared in the dataset.

If you suspect that an account or online credential was exposed, use trusted breach notification services and follow guidance from your bank or card issuer.

For payment cards, your bank is the most useful source of information about suspicious transactions or compromised card numbers.

Do not enter your card details into websites claiming to check whether your card appeared on a criminal marketplace.

A site asking for your full card number, CVV, PIN, or banking password should be treated with suspicion.

What Should You Do If You Suspect Card Fraud?

Take action as soon as you notice something unusual.

1. Contact your bank or card issuer.

Report unauthorized transactions through the official phone number or banking application.

1. Block or replace the affected card.

Your bank can tell you whether the card should be frozen or replaced.

1. Review recent transactions.

Check your statements for small unfamiliar charges as well as large transactions. Criminals sometimes test compromised payment information with smaller purchases.

1. Change reused passwords.

If the same password appears on multiple accounts, replace those passwords with unique ones.

1. Turn on two-factor authentication.

Use 2FA on email, banking, shopping, and other important accounts. This adds another verification step when someone attempts to sign in.

1. Watch your accounts after the incident.

Keep checking statements and account alerts for additional suspicious activity.

These steps align with standard recommendations for people who suspect that account information has been compromised. 

What Businesses Can Learn From the BriansClub Case

Businesses should treat payment data as a security responsibility rather than simply a technical asset.

Useful measures include:

• Reduce the amount of sensitive payment data stored internally.
• Keep payment systems patched and monitored.
• Use secure payment processors.
• Monitor unusual transaction patterns.
• Train employees to identify phishing and social engineering attempts.
• Require multi-factor authentication for administrative accounts.
• Separate critical systems from ordinary workplace networks.
• Maintain a tested incident response plan.
• Review third-party vendors that handle payment information.

A breach at one organization can feed a wider criminal market. The BriansClub case demonstrates why organizations need to think about what happens to stolen information after the initial intrusion.

Is BriansClub Still Operating?

BriansClub became famous because of its role in the underground carding economy and the 2019 breach. Current claims about specific BriansClub domains should be treated carefully.

Criminal marketplaces frequently change domains, disappear, copy established brands, or create fraudulent websites pretending to represent known services.

Searching for a supposed current BriansClub website can therefore expose users to phishing, malware, scams, or other criminal activity.

There is no legitimate reason for an ordinary consumer to visit a site claiming to sell stolen payment data.

Why Criminal Marketplaces Keep Reappearing

Closing one criminal marketplace does not remove the demand for stolen information.

Cybercrime groups can move to other platforms, create new services, or use different communication channels. Law enforcement agencies therefore focus on both individual operators and the wider infrastructure that supports cybercrime.

Recent international operations show that authorities continue to target marketplaces selling stolen information and tools used for fraud. For example, the U.S. Department of Justice announced a multinational operation in 2025 that seized infrastructure associated with cybercrime marketplaces and fraud-enabling services. 

In 2026, the DOJ also announced the seizure of LeakBase, a large forum used to trade stolen databases and cybercrime tools. 

These cases show that the market for stolen information continues to receive law enforcement attention even as individual platforms disappear.

BriansClub vs. a Normal Data Breach

The terms can sound similar, but they describe different things.

A conventional data breach usually refers to unauthorized access to an organization’s systems and information.

BriansClub was primarily a marketplace for information that had already been stolen from other sources.

The 2019 BriansClub incident was unusual because criminals breached a criminal marketplace and obtained its inventory.

That distinction explains why the event attracted researchers and financial institutions. The leaked database provided information about stolen cards that had already entered the criminal ecosystem.

The Bigger Lesson From BriansClub

The BriansClub case is more than an old cybercrime story.

The 2019 breach showed how payment information can move through an underground economy, how criminals evaluate stolen records, and how researchers can use recovered criminal data to help financial institutions protect customers.

The NYU study also showed that better card technology does not remove every fraud pathway. Magnetic stripe transactions remained a source of stolen information, while card-not-present fraud became more attractive as chip technology reduced some forms of physical counterfeit fraud. 

For consumers, the practical lesson is simple. Monitor financial accounts, use unique passwords, enable two-factor authentication, and contact your bank quickly when something looks wrong.

For businesses, payment security needs to cover the entire chain, from the checkout system to vendors, employee accounts, databases, and incident response.

BriansClub demonstrated how a criminal marketplace can turn individual data theft into a larger commercial operation. The 2019 breach also showed that the same dataset can become useful to defenders once researchers and financial institutions obtain access to it.

FAQ

What is BriansClub?

BriansClub was an underground cybercrime marketplace associated with the sale of stolen credit and debit card information. Researchers studied its leaked data to understand payment card fraud and the economics of stolen card markets.

What happened to BriansClub in 2019?

Someone breached BriansClub in 2019 and obtained more than 26 million stolen payment card records. The information was later shared with financial institutions, helping them identify compromised cards. 

How many cards were exposed in the BriansClub breach?

Reports put the number at more than 26 million credit and debit card records. The dataset included information collected from cards stolen through different criminal operations. 

Was BriansClub a data breach itself?

BriansClub was primarily a marketplace for previously stolen payment information. The 2019 event was a breach of that marketplace, which exposed its stored inventory of stolen card records.

Did BriansClub steal all the cards it sold?

No. Research indicates that the marketplace largely resold card information supplied by other criminals and resellers. 

Can someone check whether their card was on BriansClub?

There is no reliable public BriansClub lookup service that consumers should use. If you suspect card exposure, contact your bank or card issuer and use established breach notification services for compromised online credentials. 

What should I do if I notice unauthorized card activity?

Contact your bank or card issuer immediately, report the transactions, and follow the bank’s instructions for blocking or replacing the card. Also review other recent transactions and secure related online accounts.

Does having an EMV chip prevent card theft?

No. EMV chips reduce certain types of counterfeit fraud, but magnetic stripe transactions can still expose card information. NYU researchers found that 85% of the stolen magnetic stripe data in the final two years of their BriansClub dataset came from cards that had EMV chips. 

Why is the BriansClub case still discussed?

The case provides researchers with rare evidence about how stolen payment card data was collected, priced, sold, and used. The dataset also helped financial institutions identify compromised cards and improve fraud defenses.