> ## Content Index
> Fetch the complete content index at: https://darkwebinformer.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# Alleged Sale of Unauthorized Access to WEX Corporate Payment System SOAP API Keys
- URL: https://darkwebinformer.com/alleged-sale-of-unauthorized-access-to-wex-corporate-payment-system-soap-api-keys/
- Published: 2026-01-11T19:09:04.000Z
- Updated: 2026-01-11T19:09:04.000Z
- Author: Dark Web Informer
- Tags: Initial Access

Dark Web Informer - Cyber Threat Intelligence

# Alleged Sale of Unauthorized Access to WEX Corporate Payment System SOAP API Keys

January 11, 2026 - 6:37:41 PM UTC 

USA 

Software Development 

### 🧩 Standalone API Access Now Available

Access high-volume threat-intelligence data, automated ingestion endpoints, ransomware feeds, IOC data, and more – independently from the above standard subscriptions. 

[View API Access ](https://darkwebinformer.com/api-details/) 

## Unlock Exclusive Cyber Threat Intelligence

Powered by [DarkWebInformer.com](https://darkwebinformer.com/)

Foundational access to breach intelligence. Track breaches, leaks, and threats in real time with high quality screenshots and concise expert summaries. 

📚

**5,100+ Blog Posts (PRO/ELITE)**  
Continuously updated breach reports and threat summaries.

📢

**52,200+ Alerts (PRO/ELITE)**  
Daily breach, leak, and DDoS alerts.

📤

**Unredacted Threat Feed**  
Live tracking with JSON export.

🔍

**Leak and Breach Coverage**  
Direct access to claims and posts.

📡

**Snippets and Quick Facts**  
Concise summaries of DDoS, defacements, and breaches.

🌐

**500+ Onion and Clearnet Resources**  
Verified index of dark web sites and services.

📊

**Real Time Uptime Dashboard**  
Live status of 500+ sites.

🤖

**WhiteIntel.io API**  
Integrated checks inside breach posts.

🖼️

**High Resolution Images**  
Uncompressed, watermark free evidence.

🔑

**Keyword Notifications**  
Browser alerts for tracked terms.

[💳 Subscribe Now](https://darkwebinformer.com/#/portal/signup) [🪙 Pay with Crypto](https://darkwebinformer.com/crypto-payments) 

##  Quick Facts

Date and Time of Alert

2026-01-11 18:37:41 UTC

Threat Actor

bigbandz

Victim Country

USA

Industry

Software Development

Victim Org.

wex

Victim Site

[wexinc.com](https://wexinc.com)

Category

Initial Access

Severity

Medium

Network

Tor

##  Incident Overview

A threat actor using the handle "bigbandz" claims to be selling merchant account access for WEX corporate payment system. The access includes SOAP API keys with visibility to all daily payments made, along with the ability to issue payments and cards using the API key. The system uses XML SOAP envelope schema. 

- **Access Type:** Merchant account for WEX corporate payment system
- **API Type:** SOAP API Keys using XML envelope schema
- **Capabilities:** Visibility to all daily payments made through the system
- **Fraud Potential:** Ability to issue unauthorized payments and cards using the API key
- **Example Request:** XML version 1.0 with UTF-8 encoding using SOAP-ENV:Envelope schema
- **Example Response:** XML version 1.0 with utf-8 encoding returning soap:Envelope with XMLSchema-instance
- **Auction Details:** Ends 24 hours after first bid
- **Starting Bid:** $500
- **Step Increment:** $100
- **Blitz Price:** $1000

##  Indicators of Compromise (IOCs)

No IOCs were disclosed by the threat actor in this claim.

##  Breach Claim URL

For Subscribers Only 

If you are [a subscriber](https://darkwebinformer.com/tag/subscribers/), check the Threat Feed or Ransomware Feed in the subscribers area.

##  Image Preview

[ ![WEX Corporate Payment SOAP API Keys auction by bigbandz showing merchant account access with payment visibility](https://storage.ghost.io/c/6b/16/6b16ac9c-cd67-432f-b0f3-bbec941084ff/content/images/2026/01/978263578926359786235967823-2.png) ](https://storage.ghost.io/c/6b/16/6b16ac9c-cd67-432f-b0f3-bbec941084ff/content/images/2026/01/978263578926359786235967823-2.png) 

## Unlock Exclusive Cyber Threat Intelligence

Powered by [DarkWebInformer.com](https://darkwebinformer.com/)

Foundational access to breach intelligence. Track breaches, leaks, and threats in real time with high quality screenshots and concise expert summaries. 

📚

**5,100+ Blog Posts (PRO/ELITE)**  
Continuously updated breach reports and threat summaries.

📢

**52,200+ Alerts (PRO/ELITE)**  
Daily breach, leak, and DDoS alerts.

📤

**Unredacted Threat Feed**  
Live tracking with JSON export.

🔍

**Leak and Breach Coverage**  
Direct access to claims and posts.

📡

**Snippets and Quick Facts**  
Concise summaries of DDoS, defacements, and breaches.

🌐

**500+ Onion and Clearnet Resources**  
Verified index of dark web sites and services.

📊

**Real Time Uptime Dashboard**  
Live status of 500+ sites.

🤖

**WhiteIntel.io API**  
Integrated checks inside breach posts.

🖼️

**High Resolution Images**  
Uncompressed, watermark free evidence.

🔑

**Keyword Notifications**  
Browser alerts for tracked terms.

[💳 Subscribe Now](https://darkwebinformer.com/#/portal/signup) [🪙 Pay with Crypto](https://darkwebinformer.com/crypto-payments) 

Dark Web Informer © 2026 | Cyber Threat Intelligence 

[DarkWebInformer.com](https://darkwebinformer.com/)