BriansClub — troll.fan

BriansClub▊

For four years the biggest joke in the stolen-card business was the branding: an underground megastore hawking millions of hacked credit cards under the name, face, and photo of Brian Krebs — the reporter who ends careers like theirs — complete with a mock copyright, “© 2019 Crabs on Security.” Then in September 2019 an anonymous source handed the real Krebs the shop’s entire database: more than 26 million stolen cards, nearly a third of the underground’s whole inventory, nominally worth $566 million. Krebs did the one thing the shop’s name guaranteed he would — shipped it all to the banks so the cards could be flagged and killed. The shop that trolled the namesake got dumped by the namesake. And when Krebs filed a support ticket titled “Your site is hacked,” the administrator’s reply opened with a line for the ages.

No. I’m the real Brian Krebs here

The BriansClub administrator — smiley included — replying to the actual Brian Krebs’s support ticket “Your site is hacked.” The shop had spent four years selling stolen cards under Krebs’s name, likeness, and photo, down to the footer on every page: “© 2019 Crabs on Security.” KrebsOnSecurity, October 2019

WHO: BriansClub (briansclub[.]at) — one of the largest underground stores for stolen credit and debit card data, active since roughly 2015 FACT
THE GIMMICK: Named after, and advertised with, the name, likeness, and photo of security reporter Brian Krebs — who had nothing to do with it — since 2015; site pages carried the mock copyright “© 2019 Crabs on Security” FACT
THE DRAMA: Hacked in 2019; its full database — 26 million+ stolen cards, nearly a third of the underground’s tracked inventory, a collective asking price of $566 million per Gemini Advisory — leaked to the real Krebs, who shared it with the banks to kill the cards
THE HAUL: Roughly 9.1 million cards sold for about $126 million in bitcoin between 2015 and August 2019, per Flashpoint’s analysis of the leaked records — against a Justice Department sentencing yardstick of $500 per stolen card ATTRIBUTED
STATUS: BREACHED, INVENTORY BURNED — the shop stayed online, insisting the leaked cards were off its shelves; Flashpoint and Gemini both reported finding that claim false. No operator has been publicly identified in this record

This file is not about Brian Krebs — he is the impersonated party, and the shop’s only connection to him was theft of his face. It is a record of the cleanest irony the carding underground ever produced: a criminal marketplace that built its brand on trolling a breach reporter, got breached, and watched its namesake do exactly what his job description says — hand the stolen data to the people who could neutralize it. The through-line is the same one as the vDOS file: a shop that sells other people’s compromised data has no plan for the day someone compromises its own, and the leak reads like a full confession of the business model — resellers, commissions, pricing tiers, and 26 million victims’ cards on the shelves.

the drama timeline

A stolen-card megastore opens under the name and face of the one reporter guaranteed to take it personally — and grows into a top-tier operation while the joke runs.

The shop that sells breach proceeds gets breached — and of all the inboxes on the internet, the database lands in the one belonging to the man on the logo.

Krebs files a support ticket with the shop wearing his face. The shop answers in character — then spends the week on the forums defending the honor of its stolen-card inventory.

What “rescuing” 26 million stolen cards actually looks like: alerts, reissues, and a market suddenly missing a third of its shelf stock.

both sides, on the record

The case: BriansClub was, per its own leaked database as reported by KrebsOnSecurity, one of the largest stolen-card stores in the underground — 26 million+ stolen credit and debit cards, roughly 9.1 million sold for about $126 million, nearly a third of the entire market’s tracked inventory, fed by 142 resellers and bought by more than 50,000 customers. Every record on its shelves was a real person’s compromised card. And it did all of this while impersonating a working journalist — his name, his likeness, his photo in the ads — as a running joke at the expense of the breach victims whose data paid for it.

The response removes any doubt: caught, the shop’s administrator did not stop selling — he claimed, falsely per both Flashpoint and Gemini, that the leaked cards were off the shelves, while the shop’s own “checker service” existed precisely to sort the dead cards from the live ones. The lie was aimed at his own customers as much as anyone.

The defense, as stated: the administrator’s position, in his own messages, was that the shop itself was never hacked — “the data center was hacked” — and that everything affected had been pulled from sale, “so no worries about the issuing banks.” He answered the reporter who burned him politely, within hours, and never denied the obvious: the shop wore the name as dark-humor branding (“crab” being Russian slang for carder), not as identity theft aimed at Krebs’s wallet.

And the record has real limits: no operator of BriansClub is publicly identified anywhere in this file’s sources; no court has ruled on any of it. The MrGreen attribution is one forum administrator’s claim about a pseudonym. The revenue and valuation figures are analysts’ estimates from a stolen snapshot — careful ones, from Flashpoint and Gemini, but estimates. The only adjudicated fact in this story is arithmetic: the South Korean card counts that broke the February alibi.

YOU DECIDE

The carding underground ran a four-year bit at one reporter’s expense, and the bit had a structural flaw: if you name the store after Brian Krebs, the universe knows exactly where to deliver the database. Whoever did the breaking — a rival, per one forum admin — understood the joke better than the shop did. Twenty-six million stolen cards went from shelf stock to bank alerts in a month, the cover story died of arithmetic, and the administrator was left telling the actual Brian Krebs that he, the man selling stolen cards under a crab pun, was the real one. The victims’ cards got flagged. The market lost a third of its inventory. The archive notes that of everyone in this story, the only Brian Krebs who profited from crime was the fake one — and the only one who ended it was real.

The archive does not deify. It keeps the support ticket — and the smiley.

evidence locker

PRIMARY / REPORTING ON THE LEAK

KrebsOnSecurity — “‘BriansClub’ Hack Rescues 26M Stolen Cards” FACT — the foundational report: the 26M+ card database leaked to Krebs, the shop’s use of his name/likeness and the “© 2019 Crabs on Security” footer, the year-by-year upload figures, the data shared with bank-facing sources, Flashpoint’s $414M/$126M/9.1M-sold analysis (attributed), the “Your site is hacked” ticket and the admin’s verbatim “I’m the real Brian Krebs here” reply, and Nixon’s hacking-back framing with the vDOS precedent. krebsonsecurity.com/2019/10/briansclub-hack-rescues-26m-stolen-cards/

KrebsOnSecurity — “When Card Shops Play Dirty, Consumers Win” ATTRIBUTED — the rivalry angle: the Verified forum administrator’s claim that the hack was perpetrated by rival card-shop operator “MrGreen,” the ban, the “sending anything to Krebs is the lowest of all lows” line, the admin’s forum defense of the shop, and Krebs’s standing offer to help the rest of the market destroy itself. krebsonsecurity.com/2019/10/when-card-shops-play-dirty-consumers-win/

KrebsOnSecurity — “Takeaways From the $566M BriansClub Breach” FACT — the accounting: Gemini’s $566M collective price and $162M sold (attributed), the one-third-of-the-underground estimate, 142 resellers and 50,000+ buyers, the 21.6M still-unexpired cards, the big-bank/small-bank split in the alert response, and Gemini’s findings that both of the admin’s claims — the February breach date and the removed cards — were false. krebsonsecurity.com/2019/10/takeaways-from-the-566m-briansclub-breach/

CONTEXT & CROSS-LINKS

troll.fan — vDOS CROSS-LINK — the sibling irony: the other crime service that got its own database leaked to Krebs, cited by Flashpoint’s Nixon in this very story as the precedent for what such a leak sets in motion. troll.fan/dossiers/vdos.html

troll.fan — Crew Rivalries CROSS-LINK — the underground’s oldest weapon: hacking the rival’s shop, which is exactly what the Verified admin says happened here. troll.fan/crew-rivalries.html

troll.fan — Timeline CROSS-LINK — the 2019 breach in the scene’s wider chronology. troll.fan/timeline.html

troll.fan — Rescator CROSS-LINK — the carder who supplied the underworld this shop retailed to: the Target/Home Depot breach vendor, unmasked and interviewed a decade later. troll.fan/dossiers/rescator.html

The standard. BriansClub is documented here entirely from KrebsOnSecurity’s October 2019 reporting on the leaked shop database. Stated as fact: the shop’s existence and its use of Brian Krebs’s name, likeness, and photo in its advertising since 2015; the “© 2019 Crabs on Security” footer; the leak of 26 million+ card records to Krebs in September 2019; the sharing of that data with sources working with the issuing banks; and the administrator’s verbatim messages, reproduced as Krebs published them. Attributed and never adopted: Flashpoint’s and Gemini Advisory’s valuations and sales estimates; Gemini’s findings that the admin’s February-breach and cards-removed claims were false; and the Verified forum administrator’s claim that a rival operator called “MrGreen” carried out the hack — a pseudonymous accusation by a pseudonymous accuser, reported as exactly that. Brian Krebs appears as the impersonated party and the reporter, nothing more. No operator of BriansClub is publicly identified in this record and none is named or guessed at here. No card data, card numbers, or cardholder identifiers are reproduced — the breach victims already paid once. If a line here couldn’t survive scrutiny, it wouldn’t be on the page.