Valens Bank/Pay/Exchange targeted by weyhro ransomware group

• Ransomware group: weyhro
• Country: Germany
• Sector: Financial Services
• Announcement date: March 31, 2025

The ransomware group known as weyhro has announced a significant data breach involving Valens Bank/Pay/Exchange. According to an announcement posted on the group's leak site on March 31, 2025, the threat actors claim to have compromised the institution's technical infrastructure and sensitive customer information.

The alleged breach of Valens Bank/Pay/Exchange

The weyhro group claims to have successfully compromised the technical infrastructure and customer data belonging to Valens Bank/Pay/Exchange. This breach is reported to encompass various critical components of the institution's operations, specifically targeting its banking, payment, and cryptocurrency exchange units.

According to the claims made by the attackers, the breach is not limited to a single department but extends across multiple functional areas. The group states that it has published database dumps and source code belonging to the institution's various units. The alleged exposure is said to involve over 90,000 user accounts alongside various components of the corporate infrastructure.

In many modern ransomware attacks, groups employ a strategy known as double extortion. This method involves not only encrypting an organization's data to halt operations but also stealing sensitive information to use as leverage. By threatening to leak stolen data on public leak sites, attackers aim to pressure organizations into paying ransoms to prevent the exposure of confidential information to the public or regulators.

Claimed data and affected information

The information allegedly exfiltrated by the weyhro group is extensive and covers multiple layers of the organization's digital environment. The group claims that the leaked data includes several highly sensitive categories of information that could impact both the institution and its clients.

The specific types of data claimed to be involved in the leak include:

• User account information
• Financial data
• Customer transaction histories
• Source code
• API credentials
• Cryptocurrency wallet configurations

Beyond these categories, the group claims to have obtained full Git source code repositories, personal and financial details, payment processing pipelines, and cloud storage data. The inclusion of cryptocurrency wallet management configurations and API credentials suggests a deep level of access into the technical operations of the exchange and payment services.

Impact and potential risks

The alleged exposure of this data carries significant risks for both the institution and its customers. For the customers of Valens Bank/Pay/Exchange, the leak of personal, financial, and transaction history increases the risks of identity theft and fraud. The sensitive nature of the stolen data provides malicious actors with the necessary tools to conduct targeted social engineering or financial scams.

From a technical standpoint, the alleged exposure of source code and API keys poses a severe threat to the institution's ongoing security. Such information can be used by attackers to facilitate further attacks against the institution's systems, potentially leading to deeper unauthorized access or continuous exploitation of vulnerabilities.

Furthermore, because the institution operates within the European Union, such a breach may lead to significant administrative sanctions and scrutiny under the General Data Protection Regulation (GDPR). Additionally, the exposure of the institution's cryptocurrency infrastructure creates a specific risk that could lead to the loss of digital assets.

To mitigate such risks, organizations in the financial services sector typically focus on robust defensive measures. These include implementing multi-factor authentication, maintaining strict access controls for API keys and source code, and conducting regular security audits. Organizations also rely on continuous monitoring and rapid incident response plans to detect and contain breaches before they escalate to the level of large-scale data exfiltration.