Incident Overview

A threat actor using the handle cyandiboo posted a listing on DarkForums claiming to be selling a database from the National Bank of Ukraine's souvenir collectible coin sales service at coins.bank.gov.ua. The dataset is described as a 4 GB SQL dump updated in 2026 containing approximately 1.5 million total records across two files: a customers table with around 270,000 records including emails, phone numbers, and MD5 password hashes, and an orders table with approximately 1.2 million records containing full names, shipping addresses, phone numbers, and emails. Sample data columns visible in the listing also reference customers_inn (tax identification numbers), customers_passport, and bank_id_token fields.