Nayax investigates cloud-account intrusion amid claim of 1 billion card records stolen

Nayax said it detected unusual activity in a cloud account tied to one of its subsidiaries, blocked and contained the activity, and launched an investigation with external experts and law enforcement in Israel and the United States. In a Form 6-K filing, the payments firm said its production environment, core systems, and business operations were not affected and that it does not currently believe material information was exposed.

The disclosure followed claims by threat actor TheSyndicate, which alleged a far broader compromise lasting nearly a year and involving more than 100 TB of stolen data, including over 1 billion payment-card records, KYC data, transaction histories, API keys, credentials, source code, and internal infrastructure details. Those claims remain unverified, no proof or sample data had been released at the time of reporting, and Nayax had not confirmed the actor’s assertions about the scale or sensitivity of any data allegedly taken.