Alert: 57,000 Transak users expose their KYC data in massive leak

Transak just confirmed what many feared: their personal data was stolen. And it wasn’t a sophisticated hack, but something simpler and more terrifying: phishing on an employee’s laptop.

What happened

The ransomware group Stormous managed to access 300 GB of sensitive information, including identity documents, selfies, and financial statements collected during KYC verification. This affects 57,000 users of the platform (approximately 1.14% of its total user base).

The disturbing part: some of that data is already circulating online.

Are you at risk?

Transak uses MetaMask and Coinbase, so if you verified your identity through these platforms, your KYC data could be compromised. The good news: your funds are not at risk because Transak operates on a non-custodial model (non-custodial).

The bad news: your identity is. No credit card numbers or social security numbers were compromised, but having your photo and ID in the hands of criminals is serious enough.

What happened next

• Transak fired the employee
• Stormous is threatening to release more data if ransom isn’t paid
• The company refused to negotiate with the attackers
• Cybersecurity experts have already been hired to investigate

Lesson for the industry: KYC is necessary, but the security of this data remains the weak point of all crypto. One careless employee can cost 300 GB of personal information. This is a wake-up call for identity verification providers to strengthen their security measures, because phishing continues to be the most effective attack vector.