Lumma (LummaC2) infostealer disruption (2025)

05 STEPS

Breach → taken → resold → money → who paid

1. 1. HOW IT HAPPENED
   How it happened — Logins, autofill and crypto data stolen from infected PCs
2. 2. WHO GOT THE DATA
   Who got the data — Affiliates who subscribed to LummaC2
3. 3. HOW IT WAS RESOLD
   Was it resold — Not established by official sources
4. 4. HOW IT BECAME MONEY
   How it became money — Not established by official sources
5. 5. WHO PAID THE LOSS
   Who paid the loss — Total losses not published

TIMELINE

Time to detect, report and notify

Attack start → detection

— → — · Not published

Detection → report

Not published

Detection → customer notice

Not published

DOJ seized five user-panel domains on 19 and 21 May 2025

DATA

What was taken, and what it enables

Authentication data

Login ID · Password · Session cookie

Financial data

Crypto-wallet data

Identity data

Other

What this combination can be used for

• Identity data only → Spam, impersonation calls, targeted phishing (e.g. luring you into a reset)
• Email + password, cookie or code → Account takeover, including other services sharing the password
• Card or account data → Payment fraud, unauthorised transfers
• Full identity package → Identity fraud — loans, phone lines, new accounts

Administrators used the seized sites to hand the malware to affiliates — a structure that lets criminals without technical skills rent the tool. Law enforcement 2025-05

CRIME-AS-A-SERVICE

Roles confirmed in this case

Malware operator · LAW ENFORCEMENT

LummaC2 administrators, offering it as a service Law enforcement 2025-05

Data stealer · LAW ENFORCEMENT

Subscribing affiliates Law enforcement 2025-05

● Victim data stolen → ○ Brokered and resold → ○ Buyer takes over accounts → ○ Fraud or unauthorised payment → ○ Mule account → ○ Laundering → ○ Cash-out

● step confirmed in this case · ○ not established (which does not mean it did not happen)

GEOGRAPHY

Location facts, kept apart

Login-IP countries can differ from an attacker’s nationality or base because of VPNs, proxies and hijacked devices. Nationality appears only for individuals named by investigators and is never generalised to a country.

LOSS & PROCEEDS

Victim loss and criminal proceeds

Victim money loss

No amount established

RESPONSE & ENFORCEMENT

Company response and enforcement

Takedown · US Department of Justice · 2025-05-21 · Final

Five user-panel domains seized (2 on 19 May, 3 on 21 May) Law enforcement 2025-05

Civil action · Microsoft · 2025-05-21 · Decided

Civil action to take down 2,300 related domains Law enforcement 2025-05 · International agency 2025-05

Security spend before vs costs after

Not public — security budgets and legal costs are not estimated

SOURCES

• Law enforcement · U.S. Department of Justice — Justice Department seizes domains behind major information-stealing malware operation (2025.5.21) · checked 2026-10-03
• International agency · Europol — Europol and Microsoft disrupt world’s largest infostealer Lumma (2025.5) · checked 2026-10-03

Protect your accounts and where to report →

DETECTIVE RADAR

Lumma (LummaC2) infostealer disruption (2025) from other angles

• ✓Privacy DetectiveThis page
• △Regulation DetectiveApplies · not analysed yet

✓ analysed · △ applies, not analysed yet · not applicable: Origin Detective, Cost Detective, Distribution Detective, Inflation Detective, Discount Detective, Value Detective, Hype Detective, Hogu Index, Tax Detective, Wage Detective, Ingredient Detective (food & drinks) · All axes on one page