Invalid credit card numbers were exposed by malware during an investigation into transactions from several years ago. Deduplication and verification were necessary to determine actual card numbers.