Loading story…
YouLend disclosed that unauthorized actors accessed the network of its U.S. subsidiary, YouLend US, between June 5 and June 9, 2026. The company detected suspicious activity causing internal-network disruption on June 9; the incident exposed customer names and other personal identifiers, financial-account information, and payment-card data.
YouLend US contained and secured the affected systems, engaged external forensic investigators, and notified law enforcement. It is offering impacted individuals complimentary Cyberscout credit-monitoring services, but has not disclosed the number of people affected, the amount of data taken, whether a ransom was demanded, or the responsible threat actor.
See attribution, scope, and your downstream exposure.
2 events from the most recent confirmed update back to the earliest known activity.
YouLend US identified suspicious activity disrupting its internal network. The company secured affected systems, began a forensic investigation with an external cybersecurity firm, and notified law enforcement.
An unauthorized party accessed the network of YouLend's U.S. subsidiary, YouLend US. Files accessible during the intrusion contained personal identifiers, financial-account details, and payment-card information.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Paylogix, a technology provider for voluntary benefits administration, disclosed a cyber incident that disrupted its network and led to unauthorized access to certain systems between **November 13 and November 18, 2025**. After containment and restoration efforts, the company said its investigation found that files on the network may have been viewed or taken, exposing sensitive information tied to customer records. The compromised data may include **names, addresses, email addresses, policy numbers, and Social Security numbers**. Paylogix said it completed a review of affected files, notified relevant customers around **July 20, 2026**, and issued individual notices dated **August 14, 2026**; one state filing said about **634 Rhode Island residents** may have been affected. The company reported the incident to law enforcement, implemented additional technical security measures, and is offering **12 months of credit monitoring and identity theft protection** through Cyberscout, a TransUnion company.
Aug 25, 2026
Cybersecurity researchers reported a major exposure at **IDMerit**, an AI-driven identity verification provider, after discovering an unsecured, internet-accessible **MongoDB** instance containing **over 3 billion records** (over 1TB). Exposed data reportedly included full names, addresses, dates of birth, national ID numbers, phone numbers, and email addresses; researchers estimated roughly **~1 billion** records contained sensitive data (with duplicates likely inflating the total). The dataset was described as global in scope, affecting individuals across **26 countries**, with large volumes attributed to the **US, Mexico, and the Philippines**, creating downstream risk for **identity fraud, account takeover, phishing, and SIM-swap** activity. Separately, Australian finance technology platform **youX** confirmed an **unauthorized third-party access** incident, after which a hacker claimed theft of data tied to **444,528** Australian borrowers and additional loan-application and identity data (including driver’s licence numbers, addresses, and credit/banking-related information), plus customer/staff details associated with broker organizations. **Substack** also confirmed unauthorized access to **limited user data** (including email addresses, phone numbers, and internal account metadata) that occurred in **October 2025** but was only identified on **Feb. 3, 2026**; Substack stated **passwords and payment card/financial data were not accessed**, but the extended detection gap raised concerns about monitoring and dwell time.
Jun 29, 2026
Prosper, a prominent peer-to-peer lending marketplace, suffered a significant data breach in September 2025, resulting in the exposure of sensitive personal information belonging to 17.6 million customers and loan applicants. The breach was detected on September 2, 2025, and was publicly disclosed by Prosper, which confirmed that unauthorized access to their systems had occurred. The compromised data includes a wide range of personally identifiable information such as names, email addresses, dates of birth, Social Security numbers, government-issued IDs, employment statuses, income levels, credit status information, physical addresses, IP addresses, and browser user agent details. Prosper stated that, despite the breach, there was no evidence that customer accounts or funds were accessed or compromised. The company’s customer-facing operations remained uninterrupted throughout the incident. Prosper has reported the breach to relevant authorities and is actively collaborating with law enforcement agencies to investigate the attack. The company is still determining the full scope of the data affected and has committed to providing free credit monitoring services to impacted individuals once the investigation clarifies the extent of the exposure. The breach was added to the Have I Been Pwned database on October 16, 2025, which helped reveal the scale of the incident, specifically the number of unique email addresses involved. Prosper has advised all users to change their passwords if they have not done so since the breach and to enable two-factor authentication for enhanced security. The company has also published a dedicated FAQ page to address customer concerns and provide ongoing updates. The attackers reportedly accessed the data through unauthorized queries on company databases that store customer and applicant information. Prosper emphasized that resolving the incident is a top priority and pledged to share additional information with customers as the investigation progresses. The breach has raised concerns about the security of financial services platforms and the protection of sensitive customer data. Security experts recommend that affected individuals monitor their credit reports and remain vigilant for signs of identity theft. The incident underscores the importance of robust cybersecurity measures and timely breach notification in the financial sector. Prosper’s response and transparency in handling the breach will be closely watched by regulators and customers alike. The breach has significant implications for the privacy and security of millions of individuals whose data was entrusted to the platform.
Jun 29, 2026