Breaches

Affirm Data Breach Allegedly Exposes 26.7 Million User Records on Dark Web

Zero Day Wire

— 1 min read
Affirm Data Breach Allegedly Exposes 26.7 Million User Records on Dark Web

A threat actor is allegedly selling a database containing 26.7 million user records from Affirm, the popular buy-now-pay-later financial services platform operating in the United States and Canada.

The listing appeared on the Exploit cybercrime forum on January 23, 2026, posted by a threat actor using the handle "renn." The seller claims the 1.9GB database was obtained the same day and is offering the complete dataset for $14,000 or $700 per million records with a minimum purchase of one million lines.

Sale Details

According to the forum post, the database contains over 26.7 million records. The threat actor notes that some phone numbers in the dataset may contain placeholder values. The listing emphasizes the data will only be sold once, with records updated after any sale.

Affirm provides installment payment services to consumers making purchases at major retailers and e-commerce platforms. The company went public in 2021 and serves millions of customers across North America.

Unverified Claims

The authenticity of the alleged breach has not been independently verified. Affirm has not publicly confirmed any security incident. Organizations monitoring dark web forums have flagged the listing, but the claims remain unsubstantiated until further evidence emerges.

Affirm users concerned about potential exposure should monitor their accounts for suspicious activity and consider enabling additional security measures where available.

This story will be updated if Affirm releases a statement or additional details emerge.

Read more

ClickFix Campaign Compromises Legitimate Sites to Deploy MIMICRAT — A Custom C++ RAT With 22 Post-Exploitation Commands

ClickFix Campaign Compromises Legitimate Sites to Deploy MIMICRAT — A Custom C++ RAT With 22 Post-Exploitation Commands

Elastic Security Labs has disclosed a new ClickFix campaign that leverages compromised legitimate websites as delivery infrastructure to deploy a previously undocumented remote access trojan dubbed MIMICRAT (also tracked as AstarionRAT). The campaign, discovered earlier this month, demonstrates significant operational sophistication — from multi-stage PowerShell chains that bypass Windows security controls

By Zero Day Wire
ShinyHunters Linked to Device Code Vishing Attacks Targeting Microsoft Entra Accounts via OAuth 2.0 Abuse

ShinyHunters Linked to Device Code Vishing Attacks Targeting Microsoft Entra Accounts via OAuth 2.0 Abuse

A new wave of attacks is combining voice phishing (vishing) with OAuth 2.0 device authorization abuse to compromise Microsoft Entra accounts at technology, manufacturing, and financial organizations — bypassing traditional phishing infrastructure entirely. Sources told BleepingComputer they believe the ShinyHunters extortion gang is behind the campaigns, which the threat actors

By Zero Day Wire