Magnifi · Breach

Allegation: actor sells data of 69,660 Magnifi accounts

Nov 07, 2026 · 1 min read

An actor known as "tarot" is selling an alleged customer account export from Magnifi, a U.S. AI-powered investment platform owned by TIFIN. The claimed dataset includes 69,660 email addresses, 69,225 account numbers, and 11,626 ACH-linked accounts; authenticity remains unverified. Customers should enable two-factor authentication and treat suspicious contacts with caution.

By HIFY Radar newsroom Updated 11/07/2026 04:18 PM Get this every day →← Back to the feed 1 source

MediumBreachNo software to update

In this article

What happened
Why it matters
What to do
For the technical team
Timeline
Sources

What happened

An actor named "tarot" is selling an alleged complete customer account export from Magnifi, a U.S. AI-powered investment platform owned by TIFIN. The dataset would include 69,660 email addresses, 69,225 account numbers, and 11,626 ACH-linked accounts. Authenticity of the data and claimed access remains unverified.

Why it matters

If confirmed, the leak exposes identity and financial data of investment customers, enabling targeted scams and account fraud. The seller also claims production credentials, which would raise the risk of unauthorized access.

What to do

Monitor Magnifi and Apex accounts for unusual activity, enable two-factor authentication, and treat contacts citing account details with suspicion. TIFIN should investigate the claim and revoke any exposed production credentials.

For the technical team

Affected: Magnifi (TIFIN) Magnifi, plataforma americana de investimentos com IA · Magnifi, a U.S. AI-powered investment platform owned by TIFIN, with brokerage clearing through Apex. Versions not stated.
Exploitation: No confirmed exploitation. The seller published sample records; authenticity of the data and claimed access is unverified (report by DarkWebInformer on X).
Fix: Not applicable; sources cite no fix.
Vector: Initial vector unknown. The seller cites alleged production credentials, a client-side AES key, and potential GraphQL authorization vulnerabilities as evidence of access.
More details: Actor known as "tarot". Claimed dataset: 69,660 unique email addresses, 69,225 account numbers, 11,626 ACH-linked accounts, and 2,699 accounts holding about $2.02 million in equity, plus customer names, account statuses, and investment experience. The seller also offers alleged production credentials, a client-side AES key, internal API documentation, and information about potential GraphQL authorization vulnerabilities. Samples published; nothing verified.