> ## Content Index
> Fetch the complete content index at: https://darkwebinformer.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# 11.8 Million Transfast Payment SMS Records Offered With Portal Access
- URL: https://darkwebinformer.com/11-8-million-transfast-payment-sms-records-offered-with-portal-access/
- Published: 2026-09-08T16:15:24.000Z
- Updated: 2026-09-08T16:15:24.000Z
- Author: Dark Web Informer
- Tags: Data Breaches

Breach Report United States Payments Live Access Claimed 

## 11.8 Million Transfast Payment SMS Records Offered With Portal Access

A forum actor posting as **Marx** is advertising access to what they describe as a live database of messaging records belonging to **Transfast**, a cross border payment network acquired by Mastercard in 2019 and now operating as part of its transaction services business. The material is **not payment card data** but the **SMS delivery logs of a messaging portal** used to send transactional notifications, containing **recipients' phone numbers, transaction confirmations and money transfer details**. The dashboard shown reports **11,835,390 messages, all recorded as delivered, between January and early September 2026**. The actor offers a sample and links to the portal itself. The claim is **unverified**.

Severity HIGH 

[ ![WhiteIntel, dark web exposure monitoring](https://storage.ghost.io/c/6b/16/6b16ac9c-cd67-432f-b0f3-bbec941084ff/content/images/2026/08/whiteintel_io_banner.jpg) ](https://whiteintel.io/?utm%5Fsource=darkwebinformer.com&utm%5Fmedium=referral&utm%5Fcampaign=whiteintel) 

Messages11,835,390

PeriodJan to Sep 2026

AccessClient portal

ActorMarx

### ▣Post details

TargetTransfast

ParentMastercard

CountryUnited States

SectorCross border payments

ListingAccess and sample offered

Volume11.8M messages

Stated sourceMessaging portal

ObservedSep 7, 2026

### !What the post claims

- 11,835,390 messages
- All recorded as delivered
- January to September 2026
- Database described as live
- Recipient phone numbers
- Transaction confirmations
- Money transfer details
- Message direction types
- Account profile filtering
- Delivery status counts
- Traffic volume charts
- Client portal access shared
- Sample of 10,000 records
- Payment network named
- Parent company named
- Contact by messenger
- No price stated
- No mechanism described

### ◱Screenshots

[ ![Forum post advertising messaging records tied to a cross border payment network, September 2026](https://storage.ghost.io/c/6b/16/6b16ac9c-cd67-432f-b0f3-bbec941084ff/content/images/size/w1304/format/webp/2026/09/19728359287365872356978623359871325987298375.png) Screenshot 1 Redacted preview ](https://storage.ghost.io/c/6b/16/6b16ac9c-cd67-432f-b0f3-bbec941084ff/content/images/size/w1304/format/webp/2026/09/19728359287365872356978623359871325987298375.png) [ ![Traffic chart shown in the same post alongside contact details, shown redacted](https://storage.ghost.io/c/6b/16/6b16ac9c-cd67-432f-b0f3-bbec941084ff/content/images/size/w1304/format/webp/2026/09/19728359287365872356978623359871325987298376.png) Screenshot 2 Redacted preview ](https://storage.ghost.io/c/6b/16/6b16ac9c-cd67-432f-b0f3-bbec941084ff/content/images/size/w1304/format/webp/2026/09/19728359287365872356978623359871325987298376.png) 

Forum post advertising Transfast messaging records, observed 7 September 2026.

### ☷Mapped techniques

Mapped from the actor's own account. Claimed, not confirmed.

- Initial access [T1078](https://attack.mitre.org/techniques/T1078/) Valid accounts Inferred The proof is a signed in view of a messaging provider's customer portal with filters and reporting intact, which indicates account access rather than a database taken offline.
- Collection [T1213](https://attack.mitre.org/techniques/T1213/) Data from information repositories Stated Message logs covering eight months are queryable through the portal, and a sample has been extracted from them.
- Credential access [T1111](https://attack.mitre.org/techniques/T1111/) Multi factor authentication interception Inferred Conditional and unconfirmed. Transactional messaging channels commonly carry one time codes as well as confirmations, and if any appear here then live portal visibility becomes a credential problem rather than only a privacy one.

### ⚠Potential impact

Message logs from a payment network tie **a phone number to a confirmed transfer**, which produces a list of people who recently moved money and roughly when, and that is the working brief for remittance fraud. The affected population sharpens it, since cross border transfer customers are **frequently migrant workers sending money home**, a group already targeted heavily and often reachable in a second language. The unresolved question is whether the same channel carries **one time codes**; if it does, then **live visibility of delivered messages is an account takeover capability**, not a historical disclosure, and the urgency changes completely.

### iStatus Unverified

Framing matters here more than usual: what is shown is **a messaging provider's portal serving the payment company**, and nothing in the post indicates a compromise of Mastercard's own payment systems. The dashboard is internally coherent, with delivery counts matching the traffic chart across the stated period, but **a screenshot demonstrates a session rather than access that persists**, and no acquisition route is given. The account is **days old with almost no standing**. Dark Web Informer has **not retrieved the sample, is not linking the portal or contact addresses**, and neither company has publicly addressed the claim.

Want everything on this breach? **Paid subscribers** get the full unredacted claim details and more. After subscribing, check out the [threat feed](https://darkwebinformer.com/threat-feed/?utm%5Fsource=alert&utm%5Fmedium=card&utm%5Fcampaign=transfast-2026-09-07&utm%5Fcontent=threat-feed) and search there for this alert.

[View pricing →](https://darkwebinformer.com/pricing?utm%5Fsource=alert&utm%5Fmedium=card&utm%5Fcampaign=transfast-2026-09-07&utm%5Fcontent=pricing-button) 

[Dark Web Informer](https://darkwebinformer.com/?utm%5Fsource=alert&utm%5Fmedium=card&utm%5Fcampaign=transfast-2026-09-07&utm%5Fcontent=footer) // Threat Intelligence