According to Transak, the attackers gained access to sensitive information through an unauthorized break-in on an employee’s laptop. The attack, carried out through a sophisticated phishing scheme, allowed the cybercriminals to compromise data, including the names of more than 92,554 users.
Transak has more than 5 million users, and less than 2% of users were affected by the breach, according to a blog post from the company on Oct. 21. The post also noted that Transak has already engaged law enforcement to investigate and plans to notify all affected users.
Other digital wallet providers such as Trust Wallet, Metamask, Ledge, and Coinbase also use Transak’s payment solutions to convert fiat currencies like US dollars into cryptocurrencies including Bitcoin and Ethereum. As a result of the incident, some of them may temporarily suspend support for the service until the situation is fully investigated. However, the company says that the stolen KYC data has not yet been seen in criminal schemes.
While there is no confirmation of the stolen information being misused, Transak advises all affected users to be vigilant and watch out for suspicious activity. The company will soon contact users to provide advice on how to protect their personal data and offer identity monitoring services.
The incident attracted the attention of the cybercriminal group Stormous, which claimed responsibility for the hack. The group claims to have stolen over 300 gigabytes of user data and posted some of it on its website. Earlier this year, Stormous also hacked the Fractal ID web3 authentication protocol.