Infinox listed on Arkana ransomware leak site

• Ransomware group: Arkana
• Country: United Kingdom
• Sector: Financial Services
• Announcement date: May 29, 2025

Arkana claims to have breached Infinox

The threat actor known as Arkana has published an announcement on its leak site claiming to possess data belonging to the financial services firm Infinox. According to the post, the group targeted the organization on May 28, 2025, and subsequently listed the firm on their leak site on May 29, 2025.

The Arkana group claims to have exfiltrated a massive volume of information from the firm's systems. Specifically, the group alleges they have obtained over 202,000 KYC records and 163,000 customer entries. To support these claims, the group provided a data sample link, which is stated to be 15.58 GB in size.

Alleged data contents and scope

The data allegedly stolen during this incident is highly sensitive, containing various forms of personally identifiable information and technical logs. The information claimed to be part of the breach includes the following:

• Customer KYC records
• Full names
• Dates of birth
• Document numbers
• ID/DL/passport images
• Email addresses
• Server logs, including IP addresses and user agents
• Metadata

The presence of such detailed documentation, particularly images of identification documents, highlights the severity of the alleged exfiltration. In many ransomware scenarios, groups utilize a tactic known as double extortion, where they not only encrypt an organization's data but also threaten to leak sensitive information on public forums to increase pressure during ransom negotiations.

About Infinox

Infinox is a financial services company based in London that provides forex and CFD trading services to investors worldwide. It offers access to various financial instruments through its online trading platforms.

Analysis and potential implications

This alleged breach may pose secondary risks such as identity theft and targeted phishing attacks for Infinox customers. Given the sensitive nature of the data involved, including identity documents and contact information, individuals may face increased exposure to fraudulent activities.

Considering the sensitivity of the data, it may be advisable for affected individuals to closely monitor their financial accounts. For an organization in the financial sector, a failure to protect customer data may result in significant reputational damage and a loss of client trust.

Furthermore, since the firm is based in the UK, a confirmed breach could lead to legal sanctions and administrative fines under the UK GDPR. While information regarding the Arkana group is limited and their specific tactics have not yet been fully analyzed, the potential impact of such an event on a regulated financial entity is substantial. Organizations in this sector typically focus on robust defensive measures, such as multi-factor authentication, encryption of sensitive data at rest and in transit, and continuous monitoring of network traffic to detect unauthorized exfiltration attempts.