2026 Funded Trader Markets — signup access-control vuln Aug 17–19; PII + masked cards (no census yet)
Data compromised
Per FTM customer notice: name, email, phone, billing address; order history (account types bought); IP address and approximate location; if paid by card, masked card number only (first six + last four digits). Trading positions/accounts not affected per company.
Technical writeup
Verified company customer notice — August 2026. Funded Trader Markets (FTM; fundedtradermarkets.com / FTMarketLive) emailed clients an “Important security notice about your FTM account” stating that on 17 August 2026 an unauthorised party accessed the database behind its website through an access-control vulnerability in the sign-up system. Security team discovered the incident on 18 August and fully remediated it by 19 August. Company states trading positions were untouched and trading ran normally. Involved data per notice: name, email address, phone number, billing address; order history (account types bought); IP address and approximate location; for card payers, a masked card number only (first six and last four digits, which cannot be used to make a payment). Customers told they do not need to change account settings but should stay alert. No public individual census in the notice reviewed — recordsAffected 0 pending FTM attestation. Distinct from prop-firm “account breach” (drawdown) FAQ language and from the separate unverified FPFX Tech multi-firm claim.
Root cause
Unauthorized party accessed website database via an access-control vulnerability in the sign-up system (Aug 17); discovered Aug 18; remediated Aug 19 per company customer email