Forex data leak claims spark fears of fraud and market manipulation

Sensitive Forex trading data may be circulating on underground hacker forums, according to posts spotted by the Cybernews research team.

Forex data may be being sold in an underground hacker forum. Forex, the global marketplace where over $7.5 trillion is traded daily, remains the world’s largest platform for exchanging national currencies.

A threat actor recently claimed to hold 438,000 user records and 185,000 transaction records from Forex, though only a limited sample was provided to back up the claims.

Cybernews researchers have checked the data sample and found one user record and sixteen transaction entries. No downloadable links were offered, suggesting the actor is looking to negotiate a price for the dataset.

What data is allegedly up for sale?

The sample contains minimal personally identifiable information, including emails, usernames, and user IDs. Transaction records included user IDs, transaction IDs, reference numbers, and payment amounts.

Cybernews researchers warned that, if genuine, this information could expose trading patterns and facilitate market manipulation or fraud targeting Forex users.

“This transaction info could expose trading patterns which could lead to market manipulation, as well as transaction-related scams to the users, since this info can be cross-referenced,” our research team explained.

Forex data was allegedly breached before

Cybernews also discovered an entry selling Forex Australia data on a different underground marketplace. The entry was published on March 18th by another threat actor.

That post claimed 500,000 lines of data, with around 438,000 records actually available for download. Unlike the more recent claim, this dataset included PII such as full names, dates of birth, addresses, emails, and phone numbers, but no transaction details were present.

The format and content of the records differ significantly across posts, meaning the alleged stolen datasets are not identical.

At this stage, there is no confirmation that the data originates from Forex, and the authenticity of both claims remains uncertain.

Cybernews has reached out to Forex for comment on the cyberattack allegations, but has not received a response before publication.

Unlock more exclusive Cybernews content on YouTube.