On September 23, 2024, cryptocurrency payment processor Transak.com appeared on the leak site of the Stormous ransomware group. The listing states that attackers exfiltrated more than 300GB of internal files containing sensitive personal documents, including government-issued IDs, proof of address, financial statements, and user selfies. The number of affected individuals remains unknown, and the disclosure does not specify whether a ransom demand was made or if any data has been publicly released.
Already exposed?
You can’t unleak data. You can take away what it’s worth.
A leaked record is where it starts, not where it ends. What turns it into your front door is the look-up sites publishing your address beside your name — and those are what an AI reads when somebody asks about you. The free scan shows you both. We write to 580 companies.
See what is exposed about you — free scan →Watch Transak.com
Get alerted the next time Transak.com files a breach with any US regulator — the filing, dated and sourced. A free single-company slice of Signals; no account needed.
We’ll email you only about Transak.com’s future breach filings and how to watch a whole vendor list — not general marketing. Unsubscribe any time.
Watching your whole vendor list (50 to 500 companies, by tier) is GalaxyWarden Signals.
Details from the Leak-Site Listing
The primary disclosure on the Stormous leak site, archived via ransomware.live, claims the data was taken during a ransomware attack on Transak.com. It explicitly lists the compromised material as government-issued IDs, proof-of-address documents, financial statements, and user selfies. The listing does not quantify the exact number of records impacted, nor does it provide samples or confirm whether customer transaction records or wallet addresses were included. As of the publication date, the site shows no clear indication of whether negotiations occurred or if the data has been fully published.
Why This Matters for You and Your Family
If you have ever used Transak.com to buy, sell, or transfer cryptocurrency, your personal verification documents may now sit in an attacker-controlled archive. Government-issued IDs and user selfies are high-value items for identity thieves because they enable synthetic identity fraud, account takeovers, and impersonation at banks or government agencies. Even if your name is not among the unknown total of affected users, the exposure creates long-term risk for anyone whose documents were uploaded for KYC compliance. Families are particularly vulnerable when one member’s breach links to shared addresses or joint financial accounts.
The Doxxing and Identity-Chain Implications
Leaked IDs, selfies, and proof-of-address records allow attackers to map pseudonymous crypto activity back to real-world identities. Once a single document ties an email or phone number to your name, subsequent leaks of gaming credentials, social-media handles, or reused passwords can be chained together. This is exactly how doxxing campaigns escalate: a credential from one breach unlocks another account, which then reveals family members’ details. Credential leaks like this one frequently cascade into account takeovers on gaming platforms, where children’s accounts become entry points for further harassment or extortion. Continuous monitoring that understands these identity chains is essential because traditional breach alerts rarely connect the dots across crypto services, email providers, and gaming logins.