A threat actor claims to have published approximately 100,000 billing, payment, and customer records from a prominent Cambodian payment gateway on an underground forum, highlighting significant operational and fraud risks for integrated merchants and consumers.
If your team may be exposed to a similar threat, FemtoSec can help validate blast radius, prioritize remediation, and connect the issue to a practical security program.
An alleged data breach targeting Brazilian payment gateway and digital banking platform PagBank has surfaced on underground forums. A threat actor claims to possess a database containing information related to 10 billion transactions, highlighting the growing cybersecurity risks facing the fintech sector.
September 20, 2026
A threat actor claims to have leaked more than 100,000 records from a public water management entity, exposing Peruvian national identity document numbers, citizen names, emails, and internal complaint registries.
An 8 GB SQL database archive has been leaked online, exposing sensitive student records, institutional identifiers, and emails. The incident highlights critical security gaps in public-facing educational platforms and the immediate danger of secondary credential abuse attacks across enterprise environments.
An underground database dump containing approximately 100,000 structured billing and transaction records has surfaced on the cybercrime forum Leakbase, attributed to Cambodian payment integration provider BILL 24 Co., Ltd. The exfiltrated dataset, packaged in comma-separated values (CSV) format, encompasses sensitive commercial transaction histories, merchant ledger entries, customer contact identifiers, invoice dates, and internal system metadata. For financial institutions and merchants operating across Southeast Asia and international processing corridors, this incident underscores the severe secondary exposure created when centralized billing automation platforms suffer confidentiality breakdowns.
The unauthorized listing claims to provide unfiltered access to back-office operational tables maintained by the payment gateway platform. While raw database dumps often contain incomplete remnants, the structure of this release points to direct table extraction or automated report harvesting from core billing environments.
According to the listing metadata and intelligence analysis, the compromised fields comprise several sensitive operational attributes:
Customer Personally Identifiable Information: Full names, billing contacts, and communication records linked directly to consumer payment attempts.
Merchant and Supplier Data: Enterprise supplier registries, merchant profile identifiers, and downstream vendor references.
Transaction Financial Metadata: Concrete transaction sums, currency entries, payment statuses (including successful, pending, and failed states), and specific invoice processing dates.
System Identifiers and Internal Account Metadata: Internal database primary keys, account linkage hashes, and billing reconciliation tokens used across the payment pipeline.
The presence of detailed transaction statuses paired with supplier records presents an acute commercial exposure. Unlike simple credential dumps containing unsorted usernames and passwords, structured billing records offer immediate utility for fraudulent exploitation, corporate impersonation, and invoice manipulation schemes.
While the affected organization has not issued a technical post-mortem detailing the root cause of the intrusion, threat intelligence indicators and typical threat patterns targeting payment processing architectures point to several probable exfiltration vectors.
Modern payment gateways rely heavily on RESTful APIs and microservice endpoints to communicate with banking entities, microfinance institutions, and utility providers. Vulnerabilities such as Broken Object Level Authorization (BOLA), insecure direct object references (IDOR), or unauthenticated export endpoints frequently allow external actors to systematically query and enumerate transaction sequences. When API gateways lack rigorous rate limiting and token scope validation, automated extractors can rapidly iterate through account identifiers and drain complete database schemas without triggering basic volumetric alerts.
Infostealer families like Lumma, RedLine, and Vidar continuously harvest administrative browser sessions, database management console credentials, and virtual private network (VPN) authentication tokens across corporate endpoints. If an internal engineer or operations specialist experienced a device compromise, stored session cookies for platforms such as phpMyAdmin, cloud database interfaces, or custom administrative portals could allow adversaries to execute bulk SELECT queries and dump tables directly to CSV format without deploying local malware onto production servers.
Database administrators frequently run scheduled database dumps to create point-in-time recovery archives. When these snapshots or analytical reporting exports are placed into misconfigured cloud storage repositories, such as public Amazon S3 buckets or open file transfer servers, threat actors scanning public IPv4 ranges can discover and download them without requiring privilege escalation. If an organization does not employ proactive Attack Surface Management to inventory external assets, these exposed repositories can remain accessible for months.
When financial transaction datasets enter underground circulation, the threats extend far beyond the initial target entity. The threat actor published the collection within a premium tier on Leakbase, meaning motivated cybercriminals and financial fraud syndicates now hold actionable data against thousands of commercial relationships.
With precise knowledge of legitimate invoice dates, outstanding amounts, and supplier identifiers, adversaries possess the exact telemetry required to execute convincing Business Email Compromise (BEC) attacks. Threat actors can register lookalike domains mimicking legitimate utility companies or suppliers, initiate contact with affected accounts payable teams, and request bank account routing modifications under the guise of reconciling pending invoice amounts.
Consumers whose phone numbers, email addresses, and active billing arrangements appear in the dataset face sophisticated spear-phishing campaigns. Fraudsters commonly craft SMS and email lures referencing real transaction balances or alleged failed payment notices, directing victims to credential-harvesting portals designed to siphon banking credentials and one-time passwords (OTPs).
Payment aggregators serve as critical bridges connecting microfinance institutions, enterprise merchants, and commercial banks. When an aggregator suffers a data breach, integrated banking partners often must suspend API access or enforce mandatory security recertification. This operational friction degrades consumer trust and can introduce severe liquidity and reconciliation challenges across integrated platforms.
Financial technology operations handle regulated financial records that trigger stringent reporting mandates across multiple jurisdictions. Even when an incident originates within an emerging financial ecosystem, cross-border payments often tie organizations to international compliance frameworks.
Key compliance and legal considerations include:
Mandatory Breach Notification: Regulatory bodies supervising payment service providers generally require prompt disclosure of data security failures involving financial metadata. Failure to disclose breaches within mandated operational windows invites regulatory sanctions and operational license reviews.
Payment Card Industry Standards: Although this leak centers on billing ledger records rather than primary payment card account numbers (PAN), the infrastructure supporting payment processing falls under rigorous scrutiny. Compromised environments often require mandatory independent forensic investigations to confirm whether cardholder data environments (CDE) remained isolated.
Third-Party Vendor Due Diligence: Downstream enterprises that contracted the gateway for utility collection face legal responsibilities to notify their end-users if customer identifiable information was compromised through their digital supply chain.
Continuous surveillance of threat actor infrastructure is critical to measuring exposure after a breach occurs. Organizations seeking to identify whether corporate identifiers or executive accounts have surfaced across underground forums can leverage ongoing Dark Web Monitoring to intercept compromised assets before fraud execution begins.
Free exposure check
Dark Web Scanner
check dark web mentions, compromised account indicators, malware log signals, public breach exposure, and recent underground market activity for your domain.
Security teams managing digital payment pipelines, partner integrations, or utility billing architectures should initiate defensive verification immediately to protect their ecosystems from secondary exploitation.
Examine all third-party API keys and merchant webhooks associated with billing aggregators. If an upstream or downstream provider suffers a suspected compromise, assume that shared secret keys and administrative API tokens may have been exposed. Invalidate and rotate all webhook secrets, service account credentials, and mutual authentication certificates immediately.
Review database engine audit logs across production and analytical clusters for anomalous extraction behaviors. Search specifically for the following telemetry signals:
Large-scale query execution commands such as SELECT * targeting customer, invoice, and merchant relationship tables without pagination filters.
Unusual invocations of administrative export procedures, including INTO OUTFILE or mass CSV generation jobs executed during non-standard operational hours.
Unauthenticated or single-factor connections originating from unfamiliar autonomous system numbers (ASNs) or hosting providers to database management interfaces.
Alert internal finance and accounts receivable teams to exercise elevated verification protocols for all incoming payment instructions. Enforce out-of-band verification via cryptographically signed communications or confirmed voice verification before altering supplier remittance accounts, regardless of whether the request includes authentic invoice numbers and legitimate balance totals.
