Threat actor claims to sell American Express 'VIP user database'
A threat actor on a dark web forum advertises a 2026 "VIP User Database" it attributes to American Express, with names, phone numbers, addresses, gender, age and "VIP level" and discount fields. The sample appears limited to one US metro area and, per the source's analysis, the fields point to a loyalty or marketing list. American Express has not confirmed any incident; treat the claim as unverified and monitor intelligence channels.
What happened
A threat actor on a dark web forum advertises the sale of a 2026 database it attributes to American Express. The shared sample includes names, phone numbers, addresses and "VIP level" and discount fields. American Express has not confirmed any incident known to the source.
Why it matters
If real, the database exposes personal data of customers in one US metro area, enabling phone scams and targeted phishing. The source's analysis says the fields point to a loyalty or marketing list and the data may be mislabeled or come from a third party. There is no evidence of card or account data exposure.
What to do
Treat the claim as unverified and monitor intelligence channels for confirmation or denial from American Express. Reinforce customer guidance on scams using name, phone and address. Check whether marketing or loyalty partners protect this kind of data.
For the technical team
- Affected
- American Express, operadora de cartões dos EUA; base alegada de usuários "VIP" · Alleged 2026 database attributed to American Express; sample appears limited to one US metro area.
- Exploitation
- Unverified threat-actor claim reported by DailyDarkWeb. American Express has not confirmed any incident; the source classifies it as an attacker claim, not confirmation of a breach.
- Fix
- Not applicable; the source cites no product flaw or fix.
- Vector
- Advertisement on a dark web forum with a sample of records attached to the post. The source does not describe how the data was allegedly obtained.
- More details
- Sample fields: full name, phone number, physical address, city, postal code, gender, age, "VIP level" and discount percentage. DailyDarkWeb analysis: "VIP" and discount fields point to a loyalty or marketing list; data may be mislabeled or come from a third party.
Timeline
Incident opened.
Sources 1 source
- @DailyDarkWeb @DailyDarkWeb
