An alleged old-timer in the international carding community and one of the top sellers of stolen bank card data has been arrested in France, and faces extradition to the United States on an indictment unsealed Wednesday in Washington, D.C.

Vladislav Anatolievich Horohorin, 27, aka BadB, holds dual-citizenship in Ukraine and Israel and was one of the earliest members of CarderPlanet, a first of its kind Russian-language carding forum that was launched around 2002 by a group of East Europeans. CarderPlanet was shuttered in 2004, and BadB had more recently been selling his stolen goods at carder.su and on his own websites, dumps.name and badb.biz, where he promoted his product in lighthearted Flash cartoons like the one above.

Authorities say the network created by Horohorin and other CarderPlanet veterans is linked to “nearly every major intrusion of financial information reported to the international law enforcement community.”



According to the indictment, Horohorin bragged online that he was one of the biggest sellers of “dumps” (account and other data stored on a bank card’s magnetic stripe) and had been a card seller for about eight years. Undercover agents from the U.S. Secret Service negotiated purchases of stolen data from him and worked with French authorities to arrest him.

On dumps.name, one of the sites linked to Horohorin, a note pleaded to fellow cyber crooks for a little courtesy. “If you think you have found some bug, xss or another vuln here and you’re thinking of hacking, please think about one thing — how much time a lot of people spent here to get the dumps, to make this shop available for underground.” The site offered to pay hackers for vulnerabilities they found if they wouldn’t use them to breach the site and steal the card data on sale there.

A list of rules and regulations on his badb.biz site called on members to show respect for site moderators and peers and said that “coarse language would only be allowed under exceptional circumstances.” BadB warned against untrustworthy sorts on the site and said he’d once been “set up by my own family members, no need for names.”

“Do not lend your money to your friends,” he wrote in 2006 on the site, adding, “only dead can be trusted.”

Horohorin was indicted in the United States last November 2009 on charges of access device fraud and aggravated identity theft and was arrested in Nice, France, while boarding a flight to Russia. He’s being held in France pending extradition to the U.S. He faces a maximum sentence of 10 years in prison and a $250,000 fine if convicted on the access device fraud charge, and an additional 2 years in prison and a fine of up to $250,000 if convicted of the identity theft charge.

See also: