Baanx Data Breach Exposes SSNs, Contact Info and More

Baanx US Corp., a financial technology company focused on digital-asset and cryptocurrency payment solutions, disclosed a data breach that occurred in September and October 2026.

The breach occurred over two separate time periods. The first incident took place over a six-day window between Sept. 23, 2026, and Sept. 28, 2026. A second incident occurred approximately three weeks later, on Oct. 17, 2026.

The exposed data included personally identifiable information such as Social Security numbers, first and last names, dates of birth, addresses, phone numbers and email addresses. Transaction history was also compromised.

In addition, the breach exposed account security credentials, including hashed passwords and encrypted multi-factor authentication (MFA) tokens.

The breach was filed with the attorneys general offices of California and Vermont starting on Oct. 30, 2026. The company began notifying affected consumers by written notice on Oct. 30, 2026.

Baanx's response to the breach

Baanx provided guidance on steps individuals can take to help protect themselves against identity theft. The company also provided contact information for the three major credit reporting agencies, Equifax, Experian and TransUnion, in its notice.

Baanx's notice did not mention any offer of free credit monitoring or identity protection services to affected individuals.