An unverified CVV2.SU account database indexed by leaksear.ch contains 986 records, including usernames, email addresses, and Drupal-era MD5 password hashes (leaksear.ch metadata). The metadata lists December 29, 2010 as the breach date, while public reputation pages describe cvv2.su as a suspicious, low-trust site branded as Automatic Cvv Shop (gridinsoft.com, www.scamadviser.com).
What happened
leaksear.ch indexed the CVV2.SU account dump on October 12, 2026, with no reporter named and no confirmed intrusion method in the source metadata (leaksear.ch metadata). The dataset is described as an unverified account database dump, so there is no public confirmation that it came from ransomware, scraping, misconfigured storage, or a specific site compromise (leaksear.ch metadata).
Gridinsoft classifies cvv2.su as suspicious and records the visible title as :: CVV2.SU :: Automatic Cvv Shop; Scamadviser says cvv2.su has a very low trust score and has been reported as a possible scam (gridinsoft.com, www.scamadviser.com). These sources provide public context for the site, but neither verifies how the account database was exposed.
The public domain timeline is not fully aligned with the leak metadata. Scamadviser reports a WHOIS registration date of November 25, 2014 for the current domain, while the leak metadata lists a December 29, 2010 breach date, so the 2010 date should be treated as a dataset-supplied timestamp rather than a publicly confirmed domain compromise date (www.scamadviser.com) (leaksear.ch metadata).
What data was exposed
The searchable fields are email addresses, usernames, and hashed passwords (leaksear.ch metadata). The hashed password field is described in the metadata as Drupal-era MD5 hashes, not plaintext passwords (leaksear.ch metadata).
The records also contain account timestamps and status/profile fields, including access, created, init, login, mode, signature_format, sort, status, threshold, timezone, uid, and data (leaksear.ch metadata). The metadata does not list payment card numbers, CVV values, national IDs, phone numbers, or financial account identifiers as exposed fields (leaksear.ch metadata).
CVV2 is a term used for card verification codes, and PCI SSC describes those codes as sensitive authentication data; that is context for the site's branding, not evidence that card verification codes are present in this indexed account dump (www.pcisecuritystandards.org) (leaksear.ch metadata).
Why this matters
Emails and usernames from this dump can be used for targeted phishing that references CVV2.SU or old account activity, because records tie contact details to a specific site identity (leaksear.ch metadata). MD5 password hashes raise credential-stuffing risk if a weak or reused password is cracked, and OWASP flags MD5 and SHA-1 as older, less secure password-hashing algorithms while the FTC warns that reused breached credentials can expose other accounts (cheatsheetseries.owasp.org, consumer.ftc.gov). Users whose email or username appears in the leak should change any reused passwords and turn on multi-factor authentication, since the FTC notes that MFA can protect accounts even when a password is exposed (consumer.ftc.gov, consumer.ftc.gov). If you used CVV2.SU or reused a password connected to it, check whether your email, username, or hashed password appears in this leak and reset any matching credentials (leaksear.ch metadata).
Check your exposure
Request access to check this leak source, or sign in if you already have an account. You can search it by email, hashed password, and username.
Sources
- Gridinsoft: Cvv2.su Scam Check: Low Third-Party Rating (20/100 Trust Score)
- Scamadviser: cvv2.su Reviews | check if the site is a scam or legit
- PCI Security Standards Council: Are merchants allowed to request card-verification codes/values from cardholders?
- OWASP Cheat Sheet Series: Password Storage
- FTC Consumer Advice: Have you been affected by a data breach? Read on
- FTC Consumer Advice: Use Two-Factor Authentication To Protect Your Accounts