A threat actor is advertising a database allegedly containing 500,000 records associated with FDCTech, a financial technology company, raising concerns about the potential exposure of customer information.
The dataset was advertised on October 15, 2026, with the seller claiming the information was obtained on September 2. The records are being offered for $500.
The alleged compromise has not been independently verified, and the listing does not establish whether the information originated directly from FDCTech, one of its services or another source.
Names, birthdates and contact information allegedly exposed
According to the listing, the database contains 500,000 purportedly unique records involving individuals in the United States.
The advertised fields include:
- First and last names
- Dates of birth
- Email addresses
- Phone numbers
- Residential addresses
- City, state and postal code information
The seller published a small sample containing what appeared to be personal information. Several entries had missing fields, and the sample did not establish that the records belonged to FDCTech customers.
No passwords, financial account credentials, payment card information or Social Security numbers were identified in the advertised field list.
If authentic, the information could facilitate targeted phishing, identity-related fraud and impersonation attempts, particularly when names and contact details are combined with dates of birth and residential addresses.
Origin and authenticity remain uncertain
The seller claims the database is private and has not previously been modified or distributed. However, no supporting evidence establishes those assertions.
The account advertising the records has a limited posting history, and the listing provides no technical details explaining how the information was allegedly obtained.
It is also unclear whether the advertised records represent current customers, historical users or information aggregated from unrelated sources.
The claim does not establish that FDCTech’s systems were compromised or that an attacker gained unauthorized access to its infrastructure.
No independently corroborated evidence currently establishes the alleged 500,000-person impact.
The available information is insufficient to determine whether the listing represents a new data breach, a previously exposed dataset or information incorrectly attributed to the company.
