Incident Overview

A threat actor operating under the handle "aiyewumi" claims to have breached Recurpay, an e-commerce recurring billing and subscription management SaaS platform based in India. The post describes Recurpay as handling "E-commerce / Recurring Billing / Order & PII Data" and lists the exposed fields as order details, email, full billing and shipping info, subscription ID, payment gateway data, and timestamps.

The sample data visible in the screenshot shows records containing customer names, email addresses, phone numbers, physical addresses across various Indian cities (Goa, West Bengal, Tamil Nadu, Maharashtra, Karnataka, Assam, Rajasthan), order amounts in INR, shipping methods ("Standard Shipping"), product details ("Friends Easy Adult Diapers.123", "Friends Premium Diapers", "Friends Premium Diaper Pants"), subscription statuses (fulfilled, cancelled), and timestamps ranging from 2020 to 2022. This marks the second reported breach of the platform, following a previous incident on July 2, 2025.