-
A hacker claims to give away over 1.2 million records tied to Transfast, a Mastercard-owned network.
-
The listed fields include usernames, message content, and phone-routing details that could help scammers target people.
-
Neither Mastercard nor Transfast has confirmed the claim, and the records resemble messaging logs.
A threat actor says it is giving away more than 1.2 million records linked to Transfast. A threat actor is a person or group that attacks computer systems. Transfast is a cross-border money transfer network that Mastercard owns. The database reportedly holds messaging records and phone-routing details. Scammers could use that information to target users.
A threat intelligence account on X named Dark Web Intelligence shared the claim and reported that the database was free. Neither Mastercard nor Transfast has publicly confirmed the exposure. Nobody knows yet whether the dataset is real or how it appeared online.
Hacker Offers Free Database Tied to Mastercard Network
Mastercard finished buying Transfast in July 2019. The press release title says the deal further extends Mastercard’s payment network. At that time, the company called Transfast a global payments network. It served more than 125 countries. Its services covered person-to-person, business-to-person, and business-to-business transfers. Partner banks and financial institutions helped carry out those transfers, according to Mastercard’s announcement.
The threat actor’s listing says the dataset holds more than 1.2 million records. The advertised information reportedly includes usernames and account creation dates. It also lists originating and destination addresses, countries, mobile operators, and network codes.
Other listed fields include ported-number indicators and message IDs. The listing also mentions message content, transaction rates, and delivery error codes. Message content appears in that list, so the actual words of texts may be inside. Only the listing describes these fields, and no outside check has confirmed them.
Listed Fields Point to a Messaging Service, Not a Payment System
The reported fields raise questions about where the information really came from. The records do not look like a conventional payment database. They appear more consistent with SMS or messaging gateway logs. A gateway works like a post office for text messages, sorting and sending each one along.
This difference matters. The exposure may involve a communications service connected to Transfast, not its core payment system. There is currently no verified evidence that Mastercard’s payment systems were compromised. Customer financial accounts also show no confirmed signs of a break-in.
A separate report from Secusy.ai adds another layer. It does not come from the Dark Web Intelligence post. The firm published it on October 10, 2026, and it documented a Transfast-related data listing. In that listing, an actor using the alias Marx advertised 11.8 million payment-related SMS records. The actor also offered access to a portal.
According to the report, screenshots showed a messaging provider’s portal that served the payment company. The researchers found no evidence in the listing that Mastercard’s own payment systems were breached. The actor’s access claims remained unverified. So did the authenticity of the records.
The two reports cite different record counts. Evidence is too thin to say whether they describe separate listings or different versions of one dataset. They could also be unrelated claims. Readers should not merge them into one confirmed incident.
Message Records Could Fuel Smishing Scams If Genuine
Smishing means phishing by text message. Suppose the advertised records are genuine. Exposed message content and phone-routing details could then open the door to targeted scams. Criminals could study real messages and copy their wording. They could then send convincing texts that pretend to come from a remittance service. Real wording makes a fake text harder to spot.
Such messages might trick people in three ways. Some could push recipients to open fake payment links. Others could ask for account details. A third kind could try to steal verification codes. Similar security risks can arise through document-based attacks, as demonstrated by a Microsoft Copilot prompt injection attack that used hidden text in Word documents.
Phone-routing information adds another tool. It could show which mobile networks or operators handle particular numbers. Attackers could pair that knowledge with message content. The result could make a fake text look far more believable.
Even so, there is no confirmed evidence that criminals have used the alleged records in active fraud campaigns. The danger remains a possibility for now, not a proven event.
The listing also highlights a wider risk. Financial companies often rely on third-party messaging services. A weakness in a communications provider could expose information even when the main payment network stays secure.
For now, the 1.2 million-record exposure remains an unverified claim by a threat actor. No independent sample check or official breach notice has shown how much data, if any, leaked. Mastercard and Transfast have not publicly addressed this specific claim at the time of writing. Until more evidence emerges, no one should present the alleged leak as a confirmed Mastercard breach.
People who use money transfer services should stay careful with unexpected text messages. Be wary of any message that mentions payments or account problems. Avoid unfamiliar links in those texts. Never share passwords or one-time verification codes through unsolicited messages. These steps matter most if the alleged records prove genuine.
