HamroPay / Hamro Patro: Actor claims sale of…

CriticalBreachNo software to update

In 30 seconds

Alleged

A threat actor allegedly offered data tied to about 373,000 HamroPay or Hamro Patro users for sale. The claim covers identity, account and transaction information, but remains unverified, with no official statement cited in the available evidence.

What happened

Alleged

DailyDarkWeb reported a listing that purportedly contains full KYC identity records, contact details, wallet balances, bank deposit and withdrawal data, transaction histories, credentials and some linked card numbers from the Nepalese digital wallet and lifestyle app.

Why it matters

Inferred

If authentic, combining identity documents and contact details with financial records and transaction credentials could enable impersonation, targeted phishing, account takeover and fraud. Records identifying politically exposed people could also make those users attractive targets.

What to do

Inferred

HamroPay and Hamro Patro users should treat unexpected login, payment or identity-verification messages cautiously, avoid sharing PINs or one-time codes, and monitor accounts for unfamiliar activity. Reusing the same password elsewhere would increase the potential impact, so replacing reused credentials is a prudent precaution while the claim is investigated.

Confirmed and still uncertain

Observed

What is known is that DailyDarkWeb documented the sale allegation and explicitly labeled it unverified. The evidence does not establish that an intrusion occurred, that the advertised records are genuine, how the seller obtained them, whether anyone purchased them, or whether HamroPay has confirmed the incident.

What people are saying

Alleged

DailyDarkWeb says the supposed dataset includes more than 82,000 citizen ID numbers, over 27,000 transaction PINs and password hashes, about 2,000 linked card numbers, and more than 23,000 politically exposed person entries. These figures reproduce the listing's claims rather than independently verified counts.

Evolution

Observed

The available record captures only the public circulation of a purported sale listing and an analyst's initial risk assessment. It provides no documented chain from a specific compromise to data extraction, sale or subsequent official validation.

Reach

Observed

1 independent groups, 1 updates, and 0 engagements.

Technical detail

Alleged

The advertised material allegedly spans KYC records, dates of birth, phone numbers, email addresses, national identity numbers, wallet balances, deposit and withdrawal records, transaction histories, transaction PINs, password hashes and linked card numbers. The evidence does not identify hashing methods, show whether PINs are readable, or provide technical indicators of a breach.

Sources and evidence

Observed

The evidence set contains one DailyDarkWeb post summarizing the purported listing and displaying related media. It includes no statement from HamroPay or Hamro Patro, no regulator notice, no forensic report and no independently authenticated sample of the alleged data.