The internet is a black market for exposing and selling personal information, and NBC 7 Investigates reveals one website that is hiding it in plain sight.
Stories consistently come out about massive amounts of personal information hacked from retail computers, stolen from hospitals or accidentally leaked, but where does it go?
To make real money from stolen information, thieves sell identities in bulk.
NBC 7 Investigates found one place where thousands of people's personal, identifiable information is blatantly advertised for sale: a website called Pastebin.
Law enforcement is not monitoring it, but you can.
Some victims live privately in San Diego, but their personal information is worldwide.
One woman, who asked us to identify her as “Lisa,” is disabled and does not venture much past her front steps. Instead, she does all her shopping online.
Lisa fears that is how her social security number, date of birth, phone, number and credit card ended up on Pastebin.
“I'm shocked right now my stomach. I feel sick to my stomach. It's really upsetting,” Lisa said as NBC 7 Investigates told her all her information was on the site.
Another victim, long-range trucker Steve, had his personal information posted on Pastebin one year ago.
He said since then, someone tried to steal his social security checks and used his personal information in an attempt to route his retirement money to another account.
“I made a fast trip to IRS and identified myself and said, ‘No, I had not,’” Steve said.
His personal information has also been used in attempts to open a T-Mobile account in Houston and make a purchase in an Apple store, he said.
NBC 7 Investigates approached more than 20 San Diego residents whose personal information was easily found on Pastebin, but thousands more identities of ordinary people all over the country can be found there as well.
Few officials wanted to discuss it with NBC 7 Investigates, but Pastebin has grabbed the attention of internet security expert Jim Stickley.
“Everybody uses it from the black market standpoint to sell credit cards, medical records – anything that is illegal,” Stickley said.
A Pastebin post from last March shows social security numbers for sale, while user "Yym- Card- Fresh-9" offers to sell credit cards including card verification value numbers (CVVs).
There is even a price list, on which a U.S. credit card goes for as low as $6.
“There is just so much of it happening at such a low level, it’s just impossible to keep up,” Stickley said.
In the frequently asked questions section, Pastebin creators write, “The idea behind the site is to make it more convenient for people to share large amounts of text online.”
Stickley said criminals know the site well, and so should you.
Pastebin offers only an email address for reaching administrators. NBC7 Investigates emailed three questions concerning the material on their website but have not heard back.
As for ways to take victims’ information down, Pastebin offers two ways to request removal from the site, according to the FAQs.
NBC 7 Investigates showed victim Craig where his information was posted.
“To have it in what looks like a database with my name address and the full credit card number and pin codes and the whole yards -- that was pretty startling,” Craig said.
Craig, whose information was located in the “Christmas Credit Card Mix Paste” section, emailed Pastebin, asking it be removed.
The website's policy of reading all its emails and acting within 24 hours apparently works, for his information was removed a day later.
“As it turned out this is not a card I currently use, so that was naturally a sigh of relief,” Craig said.
Whether the account is still active or not, contact all your creditors and let them know what has been posted on Pastebin if you become a victim. They may issue you a new card.
Also, notify your bank and make sure to check your credit, which is free once a year with each of the three credit reporting agencies.
A hacker’s careless use of personal information should not be at your expense, so do not wait for a knock on your door from NBC 7 Investigates. Check it out yourself because prevention is the best protection.
Credit watch services can catch fraudulent activity on your accounts, but they do cost money.