2026 Transcom (PayPal support ops claim) — N0n listing; ~86.7M agent-session records (unverified)
Data compromised
Actor claim (unverified): 86.7M connection records of daily support-agent sessions into PayPal corporate Citrix/AAA; AD/PKI/Netskope/Zscaler maps across 8 sites. Does not establish PayPal payment systems or customer wallets were breached. No samples cited in trade press.
Technical writeup
Unverified leak-site / extortion claim — N0n listing observed September 18, 2026 naming “PayPal support operations (Transcom WorldWide).” Actor claims 86.7M agent-session connection records into PayPal Citrix/AAA plus infrastructure maps. Transcom and PayPal had not confirmed at indexing; CybersecAsia notes no samples. Catalog victim as Transcom (named operator), not a confirmed PayPal core breach. recordsAffected 86700000 (unverified); companyConfirmed false.
Root cause
Unverified N0n extortion leak-site listing (Sep 18, 2026)
References
- https://www.ransomware.live/id/UGF5UGFsIHN1cHBvcnQgb3BlcmF0aW9ucyAoVHJhbnNjb20gV29ybGRXaWRlKUBOMG4
- https://cybersecasia.net/news/ransomware-group-alleges-attack-and-exfiltration-of-data-linked-to-major-payment-provider/
- https://cypro.co.uk/insights/cyber-bulletins/n0n-ransomware-claim-targets-transcom/