Cyber Threat Actor: @gift2death

The threat actor is known by the aliases @gift2death and didthe0x. Public reporting associates the actor with a location in China, though no further geographic detail is provided. The actor first came to attention in March 2016 when they disclosed customer data from the website of the Norfolk Admirals, a minor‑league hockey team. The disclosed information included names, email addresses, physical addresses and the types of credit cards used, but excluded actual card numbers. The actor communicated through Twitter and claimed responsibility for the leak under the handle @Gift2Death.

The actor stated that they had previously warned the Norfolk Admirals about lax online security, a claim the team’s leadership denied receiving. The actor published the data on Twitter and claimed responsibility for the leak under the handle @Gift2Death. The leak affected roughly 250 unique customers after duplicates and spam were removed from an initial list of over 4,000 entries. No financial account numbers were exposed because the team does not store such data in its databases. The actor also posted what they said was the team’s Twitter password, although they said they did not attempt to use it to access the account.

No specific malware families, exploit tools or initial‑access vectors are described in the available reporting; the actor’s activity is limited to the public posting of stolen data and credential information. Attribution to a state‑sponsored group or a criminal consortium is not evident from the sources, and the only stated geographic link is the unspecified location in China. The Norfolk Admirals incident remains the sole publicly reported operation associated with the actor, serving as the primary example of their observed behavior. No further campaigns or tools have been documented in open‑source material. Consequently, the profile is confined to the facts presented in the breach report and the actor’s own statements.