← Nayax

2026 Nayax — subsidiary cloud-account exfiltration; refuses ransom (Jul 14); TheSyndicate 1B+ claim disputed

2026 Unknown records affected Share on X

Data compromised

Company-confirmed exfiltration: backup of scanned documents, additional business information, and a backup copy of payment transaction records without sensitive cardholder verification data (no CVV, cardholder names, or ID numbers per Nayax). Actor-claimed: 1B+ card records, KYC, API keys, source code—unverified and disputed by company

Technical writeup

Company-confirmed subsidiary cloud exfiltration with disputed actor scale — indexed July 7–14, 2026. Forum actor TheSyndicate claimed roughly one year of access to Israeli payments fintech Nayax (NASDAQ: NYAX), 100TB+ exfiltration, and more than 1 billion card records with a July 21, 2026 release threatened. Nayax filed Form 6-K on July 8, 2026 reporting anomalous activity in a subsidiary cloud account that was immediately blocked; production environments and core payment systems were unaffected. On July 14, 2026 Nayax published investigation findings confirming data was exfiltrated from the cloud account—including scanned-document backups, business information, and payment transaction record backups—but stated the data does not include sensitive payment verification fields such as cardholder names, CVV codes, or identification numbers, and that wallet-tokenized transactions limit reuse risk. Nayax's board said it will not comply with extortion demands despite the July 21 deadline. No attested individual or card record count was published; BreachHistory indexes recordsAffected 0 while noting the unverified actor-cited 1B+ figure in prose.

Root cause

Unauthorized activity in a subsidiary cloud computing account (detected and blocked per Nayax SEC Form 6-K Jul 8, 2026); company Jul 14, 2026 confirmed exfiltration of backup documents and transaction records but not core payment credentials

References