It costs about $1,000 to purchase a person’s identity on the dark web from stolen financial accounts. Why pay $1,000 when it’s only $2 to steal a car’s identity and still make a hefty profit?
Kasada’s Threat Research team found evidence that a successful credential stuffing attack may have been performed against large automotive manufacturers, leaving accounts exposed to fraud and theft. Automated account takeover (ATO) provides bad actors with access to personal information as well as vehicle data such as car make, model, registered user, address, and vehicle identification number (VIN). These customer accounts are then resold illegally within private Telegram communities for profit.