Rescator
Attribution profile
- Type
- Criminal
- Location
- Ukraine
- Known incidents
- 1 incident
- Sources
- 0 sources
- First seen
- 2014-05-17
- Last seen
- 2014-05-17
- Updated
- 2026-10-17 01:09
- Aliases
- 1 alias
STIX characteristics
Threat actor characteristics are available to members.
Profile narrative
Rescator is a Ukrainian‑based threat actor known by the alias Rescator, who operated an underground marketplace specializing in the sale of stolen credit card data obtained from major retail breaches affecting Target, Home Depot, and Sally Beauty. The actor’s strategic objective was financial gain, achieved by selling compromised card information through a platform that allowed users to search cards by geographic criteria and processed payments directly in Bitcoin without escrow protections. Notable tactics included maintaining a carding site for data lookup, facilitating Bitcoin transactions, and uploading millions of card details to carding forums for broader distribution. While the individual behind the alias is suspected to be Andrey Hodirevski, his direct involvement in hacking remains unconfirmed, and no public evidence links Rescator to a state sponsor or a larger criminal consortium. A representative operation was the Rescator marketplace that enabled fraudulent use of card data stolen in the 2014 Target and Home Depot incidents.
Incidents
Attributed incidents are available to members.
1 incidentSources
Sources available to members: 0 sources.