Mastercard Transfast · Breach

[Single source] Actor claims leak of 1.2 million Transfast records

Nov 10, 2026 · 1 min read

A threat actor claims to be distributing a database linked to Transfast, Mastercard's cross-border money transfer network, for free. The listing cites more than 1.2 million records containing usernames, addresses, messages, network codes, and rates.

By HIFY Radar newsroom Updated 11/10/2026 11:34 PM Get this every day →← Back to the feed 1 source

HighBreachNo software to update

In 30 seconds

Alleged

A threat actor is allegedly offering, at no cost, a database tied to Transfast containing more than 1.2 million records. The claim remains unverified, and the listed fields resemble messaging gateway logs more than payment records.

What happened

Alleged

DailyDarkWeb reported a listing in which an unidentified actor claims to be distributing data associated with Transfast, the cross-border transfer network acquired by Mastercard in 2019. The post does not establish how the data was obtained or independently confirm that it came from Transfast.

Why it matters

Inferred

If authentic, message content, address information and phone-routing metadata could help criminals craft convincing phishing texts that impersonate remittance services. That risk is an analytical assessment, not evidence that such campaigns have begun.

What to do

Inferred

Transfast or Mastercard customers should treat unexpected transfer-related messages cautiously, avoid opening unsolicited links and verify requests through an official channel. These are precautionary steps based on the reported presence of message and routing data, not confirmation that any particular customer was exposed.

Confirmed and still uncertain

Alleged

The listing reportedly names usernames, dates, addresses, country and carrier codes, porting flags, message identifiers and content, rates, and delivery errors. Unknowns include whether the sample is genuine, whether the records are unique, when they were collected, which system produced them and whether Transfast has validated the claim.

What people are saying

Inferred

DailyDarkWeb's analyst note says the described columns look more like SMS or messaging gateway logs than financial transaction records. That interpretation narrows the likely data type, but it does not prove the dataset's origin or authenticity.

Evolution

Alleged

The available account connects the claimed dataset to Transfast, which it identifies as a cross-border transfer network acquired by Mastercard in 2019. The next visible step is the actor's alleged free distribution offer; the evidence provides no breach date, access method or intervening incident timeline.

Reach

Observed

1 independent groups, 1 updates, and 0 engagements.

Technical detail

Inferred

The reported schema includes originating and destination addresses, mobile-network identifiers, ported-number flags, message IDs, message bodies, rates and delivery error codes. Taken together, those fields are consistent with operational messaging logs, although the available evidence cannot tie them conclusively to a specific platform.

Sources and evidence

Observed

This report rests on one DailyDarkWeb post summarizing an alleged threat-actor listing and showing an accompanying image. No statement from Transfast or Mastercard, downloadable dataset, forensic report or independent corroboration appears in the supplied evidence, so the claimed leak and attribution remain unconfirmed.