killsec ransomware group lists DUC App: Global Money Movement, Simplified on its leak site

• Ransomware group: killsec
• Country: United States
• Sector: Technology
• Announcement date: August 20, 2025

Killsec claims to have compromised DUC App data

The US-based financial technology platform DUC App has been listed on a leak site by the threat actor group known as killsec. According to the announcement made on August 20, 2025, the group claims to have obtained sensitive data belonging to the organization. The threat actor has stated that if the company does not cooperate, they intend to release all allegedly compromised data to the public.

The announcement provided by the group includes samples of documents related to the company's financial transactions, which serves as a demonstration of the alleged breach. This type of public shaming is a common tactic used by ransomware groups to exert pressure on organizations to meet their demands. While the group has made these claims, the full extent of the breach and the validity of the samples remain subject to verification.

Alleged sensitive data includes personal and financial information

Based on the screenshots provided in the announcement, the leaked data allegedly contains a wide range of highly sensitive information. The information claimed to be part of the breach includes various identifiers that could be used for malicious purposes. The specific types of data mentioned in the listing include:

• Home addresses
• Phone numbers
• Transaction histories
• Email addresses
• Public and private crypto address keys
• Passports
• IDs
• Credit card information

The inclusion of such diverse data types, ranging from basic contact information to highly sensitive financial and identification documents, highlights the potential severity of the incident. The presence of private cryptocurrency keys and credit card information is particularly concerning for users of a financial services platform.

About DUC App

DUC App is a financial technology platform that aims to simplify global money transfers and payment transactions. The company provides digital wallet and fast money transfer services to its users, positioning itself within the competitive fintech sector.

Risk assessment and industry implications

This incident suggests that users may be exposed to significant risks of identity theft and financial fraud. Because the organization is based in the United States, a potential data breach could trigger legal proceedings under state-level data protection laws and federal regulations. The regulatory landscape in the US requires strict adherence to data privacy standards, and violations can lead to substantial legal consequences for the organization involved.

The killsec group is noted for having hacktivist origins and is reported to provide ransomware-as-a-service. Given these characteristics, it is assessed that the group may utilize double extortion tactics. Double extortion is a method where threat actors not only encrypt an organization's data to disrupt operations but also steal sensitive information to threaten the victim with its public release. This dual-layered approach increases the leverage the attackers hold over the target.

Furthermore, the company's operation in the fintech sector indicates that the leaked data could pose a high threat regarding targeted phishing attacks and supply chain risks. In the fintech industry, where trust and data integrity are paramount, a breach of this nature can have cascading effects. Organizations in this sector often face sophisticated threats because they handle high-value financial data and act as critical nodes in the global financial ecosystem. To mitigate such risks, organizations typically focus on robust encryption, multi-factor authentication, and continuous monitoring of their network environments to detect unauthorized access early.