Gate | Crypto Exchange data allegedly stolen by BYOD ransomware group

• Ransomware group: BYOD
• Country: Singapore
• Sector: Financial Services
• Announcement date: October 7, 2026

BYOD group claims compromise of Gate | Crypto Exchange

The threat actor known as BYOD has listed data allegedly belonging to Gate | Crypto Exchange on their leak site. This announcement, which surfaced on October 7, 2026, marks a significant claim of a data breach targeting the financial services sector. According to the threat actor, the breach is intended to disrupt the institution's operations. The group has issued a threat stating that if communication is not established with them, the stolen data will be released across the internet.

Ransomware groups often utilize leak sites to pressure victims into paying ransoms. This process frequently involves double extortion tactics, where attackers not only encrypt an organization's systems but also steal sensitive information. By threatening to publish this data publicly, the attackers aim to maximize the pressure on the victim through the threat of reputational damage and regulatory scrutiny. In such scenarios, the dissemination of data can create secondary risks even if a ransom is not paid, as the information remains available for malicious actors to exploit.

Details of the claimed data leak

The announcement made by the BYOD group claims that the breach involves the data of 12 million users. While the group has posted this information on their leak site, no screenshots were provided to verify the contents of the alleged breach. The specific categories of information claimed to be included in the leak are extensive and cover various aspects of user profiles and financial activity. The claimed data includes:

• Phone numbers
• Nicknames
• Balance and VIP tier information
• 2FA indicators
• UIDs
• Gender
• Assets Under Management (AUM)
• Profit rates
• Verification status
• City
• Account age
• Profile keys

The breadth of this claimed data suggests a deep level of access into the user database, potentially exposing sensitive personal and financial identifiers that are critical for identity verification and account security.

Target organization profile

The organization targeted in this incident is Gate | Crypto Exchange, a prominent entity operating within the financial services sector. Based in Singapore, the institution is subject to the regulatory frameworks of that jurisdiction. Given the nature of the claims, the organization may face legal consequences under the PDPA (Personal Data Protection Act), which governs how personal data must be handled and protected within the country.

Potential impact and industry implications

Public information regarding the BYOD group remains limited, making it difficult to assess their specific tactics, techniques, and procedures. However, the potential leak of the claimed data poses severe risks to the affected users. The exposure of such detailed information could leave users vulnerable to identity theft and highly targeted phishing attacks, as attackers could use specific details like profit rates, account age, and VIP status to craft convincing fraudulent communications.

For a financial services institution, the disclosure of financial data and specific account details can jeopardize the security of user assets and lead to significant reputational damage. When users lose trust in the security of a platform, it can lead to a loss of liquidity and a mass exodus of clients. Furthermore, the threat of double extortion means that even if an organization manages to restore its systems from backups, the threat of a public data leak remains a potent weapon for the attackers.

Organizations in the financial sector typically employ various defensive strategies to mitigate these risks. These include implementing robust encryption for data at rest and in transit, enforcing multi-factor authentication (MFA) across all user and administrative accounts, and maintaining rigorous monitoring of network traffic to detect unauthorized access. Additionally, regular security audits and adherence to regional data protection regulations, such as the PDPA, are essential components of a modern cybersecurity posture. As attackers continue to target high-value financial targets, the ability to respond to and recover from such incidents remains a critical priority for the industry.