AI-Driven Dark Web Marketplace Exposes 345,000 Credit Card Records

A dark web marketplace, Jerry’s Store, has inadvertently leaked nearly 345,000 credit card records due to an overreliance on AI-generated code. This incident has been highlighted by cybersecurity experts as a significant warning about the risks associated with “vibe coding,” where AI-written software lacks thorough human security review.

The breach raises serious concerns among regulators, financial institutions, and cybersecurity professionals, especially as digital fraud becomes more sophisticated, blending seamlessly with legitimate financial systems. Jerry's Store functioned as a "carding" platform, allowing criminals to verify stolen credit cards before use, which illustrates the growing dependence on AI in facilitating cybercrime.

Investigations revealed that the operators of Jerry’s Store used Cursor, an AI-coding platform, to create their backend systems. While Cursor is a legitimate tool, the lack of basic security measures led to the creation of an unauthenticated public directory, exposing sensitive data directly to the internet. This poor cybersecurity practice ultimately compromised the platform's operations.

Jerry's Store operated on a more complex level than a simple marketplace; it tested the viability of stolen cards through small transactions with reputable online services like Amazon and Lyft. By analyzing transaction responses, criminals could identify active cards, demonstrating the organized nature of modern carding networks.

This incident underscores a broader issue: the inherent vulnerabilities in using AI coding tools without adequate human oversight. Organizations, including startups and large firms adopting AI technologies, risk deploying insecure systems that lack essential safeguards like authentication and encryption.

The exposure of Jerry’s Store emphasizes the urgent need for regulators to treat AI misconfiguration as a serious systemic threat. As AI continues to play a role in software development, the balance between innovation and security must be prioritized to prevent catastrophic vulnerabilities in both legitimate businesses and criminal enterprises alike.