Loading story…
Nayax said it detected unusual activity in a cloud account tied to one of its subsidiaries, blocked and contained the activity, and launched an investigation with external experts and law enforcement in Israel and the United States. In a Form 6-K filing, the payments firm said its production environment, core systems, and business operations were not affected and that it does not currently believe material information was exposed.
The disclosure followed claims by threat actor TheSyndicate, which alleged a far broader compromise lasting nearly a year and involving more than 100 TB of stolen data, including over 1 billion payment-card records, KYC data, transaction histories, API keys, credentials, source code, and internal infrastructure details. Those claims remain unverified, no proof or sample data had been released at the time of reporting, and Nayax had not confirmed the actor’s assertions about the scale or sensitivity of any data allegedly taken.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
TheSyndicate said the allegedly stolen Nayax data would be released through a portal on July 21, 2026, with card-data query capability and raw file downloads, and promised a Telegram update beforehand. This was presented as part of the actor's unverified extortion or leak threat.
Nayax disclosed in a Form 6-K filing that it detected unusual activity involving one of its subsidiaries in one of the company's cloud accounts and said the activity was immediately blocked and contained. The company said it was investigating with external experts and law enforcement in Israel and the United States, while stating its production environment and core systems were not affected.
A threat actor using the alias TheSyndicate claimed to have fully compromised Nayax, remained in its systems for nearly a year, and exfiltrated more than 100 TB of data including over 1 billion card-data records. At the time of reporting, the claim was unverified and no proof or sample data had been released.
A threat actor using the alias derm0nix allegedly breached the Portal de Salud de Culiacán and claimed to have leaked 4,045 patient records from 2018 to 2026, including minors' and patients' sensitive medical data. The report stated the claim was unverified and that local authorities had not publicly addressed it.
A threat actor using the alias Saturne advertised an alleged sale of data from Follow.fr, claiming a dataset of 2,052,123 patient records in CSV format dated July 2026. The claim was reported as unverified, with samples and negotiable pricing allegedly offered to serious buyers.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
databreaches.net
Open sourcedarkwebinformer.com
Open sourcedarkwebinformer.com
Open sourcedarkwebinformer.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Ukraine’s National Bank (NBU) took its **collectible coin/numismatic online store** offline after a cyberattack against a supporting **contractor** potentially exposed customer registration data (names, phone numbers, emails, and delivery addresses). The NBU said **core banking systems were not affected** and **no payment card or banking data** was compromised, but warned the exposed PII could be leveraged for **phishing** and other follow-on fraud; the incident was described as consistent with a **supply-chain** intrusion path. In France, authorities disclosed illegal access to a portion of the **National Bank Accounts File (FICOBA)**—a government database used for tax, customs, and law-enforcement purposes—after an attacker **impersonated a civil servant** and used valid credentials to query data. Officials said up to **1.2 million accounts** may have been impacted, with exposed fields potentially including account numbers, names, addresses, and in some cases tax identifiers; **DGFiP**, supported by **ANSSI**, is investigating and notifying affected individuals while banks were alerted to heighten fraud/phishing monitoring. Separately, **Safran Group** denied being cyberattacked, stating that a leaked dataset containing “non-strategic” order/customer details was **inadvertently exposed via a third-party provider**, with external analysis suggesting the compromise occurred elsewhere in the supply chain rather than within Safran’s own systems.
Jun 29, 2026
Cybersecurity researchers reported a major exposure at **IDMerit**, an AI-driven identity verification provider, after discovering an unsecured, internet-accessible **MongoDB** instance containing **over 3 billion records** (over 1TB). Exposed data reportedly included full names, addresses, dates of birth, national ID numbers, phone numbers, and email addresses; researchers estimated roughly **~1 billion** records contained sensitive data (with duplicates likely inflating the total). The dataset was described as global in scope, affecting individuals across **26 countries**, with large volumes attributed to the **US, Mexico, and the Philippines**, creating downstream risk for **identity fraud, account takeover, phishing, and SIM-swap** activity. Separately, Australian finance technology platform **youX** confirmed an **unauthorized third-party access** incident, after which a hacker claimed theft of data tied to **444,528** Australian borrowers and additional loan-application and identity data (including driver’s licence numbers, addresses, and credit/banking-related information), plus customer/staff details associated with broker organizations. **Substack** also confirmed unauthorized access to **limited user data** (including email addresses, phone numbers, and internal account metadata) that occurred in **October 2025** but was only identified on **Feb. 3, 2026**; Substack stated **passwords and payment card/financial data were not accessed**, but the extended detection gap raised concerns about monitoring and dwell time.
Jun 29, 2026
**LexisNexis Legal & Professional** confirmed that an unauthorized party accessed a limited number of its servers after a threat actor using the alias **FulcrumSec** leaked roughly **2 GB** of allegedly stolen files on underground forums. LexisNexis stated the exposed information was **mostly legacy/deprecated data from prior to 2020** (e.g., customer names, user IDs, business contact details, products used, customer survey data including respondent IP addresses, and support tickets) and said it found **no evidence of impact to products or services**; the company reported the matter to law enforcement and engaged an external forensics firm. FulcrumSec claimed the intrusion began by exploiting the **React2Shell** vulnerability in an **unpatched React frontend application** to gain access to LexisNexis’ **AWS** environment, and alleged broader access within cloud resources (including an ECS task role and data stores) and the presence of government-related accounts (e.g., `.gov` email addresses) in the stolen dataset. Public reporting notes a discrepancy between the actor’s claims (e.g., “millions of records,” passwords, and other internal artifacts) and LexisNexis’ characterization of the exposed data as limited and non-sensitive (no SSNs, financial data, active passwords, or customer search queries), but multiple outlets corroborated that the leaked files are tied to a real, now-contained incident affecting LexisNexis’ Legal & Professional division.
Jun 29, 2026