Data Breach News2 min read
820K Records Exposed in CardMovil.com Company Leak
By InsecureWeb Team
This report reflects observations of dark web activity. InsecureWeb makes no representations regarding the accuracy of this data.
Data Breach Summary
On June 3, 2025, a threat actor named “wht” shared a dataset labeled cardmovil.com on the cybercrime forum DarkForums.st. The leak consists of a .csv file containing approximately 820,000 rows, with at least 1,146 unique email addresses, and was originally sourced in September 2024.
The data appears to contain business registration information, including:
- Company names
- Tax IDs
- Operational statuses
- Legal representatives
- Structured location and address data
- Emails (limited, but included)
Though the dataset primarily involves corporate or institutional records, the presence of identifiable individuals, emails, and full addresses may still pose a privacy and fraud risk.
Where and How?
The data was published on DarkForums, a known hub for data leaks and illicit datasets. The structured nature of the file and inclusion of unique identifiers like tax numbers and detailed addresses indicate the data may have originated from a Peruvian corporate or municipal registration system, possibly aggregated through CardMovil’s platform or services.
The .csv format makes it easy to extract, filter, and exploit the data for business impersonation, spear-phishing, or document fraud schemes.
Breach History
There are no known previous public breaches or leaks involving cardmovil.com. This incident is currently the first exposure tied to their name, marking a potentially serious security failure in how business or partner data is handled.
Further Action
If cardmovil.com is confirmed to be the original source or involved party, the following steps are advised:
- Audit all data access points and APIs.
- Investigate any third-party vendors or exposed endpoints.
- Notify affected entities whose data may be at risk.
- Improve monitoring and logging of backend activity.
What is InsecureWeb?
InsecureWeb is a Dark Web monitoring service that keeps track of recent data breaches and tracks their impact by monitoring the darkest places of the internet.
Our commitment lies in providing top-notch cybersecurity services to our clients. Through continuous monitoring of the dark web and advanced threat detection methodologies, we strive to identify potential breaches promptly, enabling swift response and mitigation efforts. With our state-of-the-art tools and expertise, we prioritize the confidentiality, integrity, and availability of our clients’ data.
