--- schema: 1 kind: incident title: > Nayax (Bank-of-Lithuania-licensed EEA payment institution) discloses a cloud-account incident; "The Syndicate" claims 1B card records — claim unverified and contradicted by the filing headline: > Nayax SEC 6-K reports a contained cloud-account incident; "The Syndicate" claims 1B card records — no proof, conflicts with the filing summary: > Nayax Ltd. — a cashless-payment-terminal provider and Bank-of-Lithuania-licensed payment institution (Nayax Europe UAB) serving enterprises across the EEA — filed an SEC Form 6-K on 2026-07-08 disclosing "unusual activity" in a subsidiary cloud account that it says it immediately blocked and contained, with production/core payment systems unaffected. Separately, extortion group "The Syndicate" claims 1B+ card records, ~1 year of dwell and 100 TB exfiltrated — unproven and internally inconsistent with the "immediately contained" account. Treat as an incident to watch for a material update, and a prompt to audit third-party/subsidiary cloud accounts touching card-data pipelines. discovered_at: "2026-07-09T04:32:59Z" updated_at: "2026-07-16T04:46:00Z" event_date: 2026-07-08 run_id: 2026-07-09T0409Z-intel priority: notable immediate_action: null tags: - data-breach - cloud - organized-crime regions: - europe - global sectors: - finance - retail entities: - "actor:the-syndicate" - "incident:nayax-cloud-account-breach-2026" techniques: - T1530 affected_products: [] cves: [] sources: - url: "https://www.sec.gov/Archives/edgar/data/1901279/000117891326003440/zk2635660.htm" publisher: Nayax Ltd. — SEC Form 6-K date: 2026-07-08 role: primary - url: "https://databreaches.net/2026/07/08/nayax-investigating-breach-the-syndicate-claims-it-acquired-1-billion-card-records-and-other-important-data/" publisher: DataBreaches.net date: 2026-07-08 role: primary - url: "https://www.calcalistech.com/ctechnews/article/rjpeasiqfg" publisher: Calcalistech (Ctech) date: 2026-07-08 role: corroborating - url: "https://www.nayax.com/news/payment-institute-license/" publisher: Nayax (company announcement) date: 2018-07-17 role: corroborating - url: "https://www.globenewswire.com/news-release/2026/07/14/3326635/0/en/Nayax-information-security-incident-update.html" publisher: Nayax Ltd. (press release) date: 2026-07-14 role: primary closed_sources: [] evidence: - quote: "As part of the company's ongoing monitoring, an unusual activity was detected in relation to one of Nayax's subsidiaries, in one of the company's cloud accounts, which was immediately blocked and contained." publisher: Nayax Ltd. — SEC Form 6-K - quote: "The company's production environment and its core systems have not been affected by the event. The company's business activity continues as normal, without impact to the company's business operations." publisher: Nayax Ltd. — SEC Form 6-K - quote: "One claim is that they have acquired over 1 billion card records. Another claim is that they have been inside Nayax's servers for almost a year, and have exfiltrated more than 100 TB of data. That claim appears to conflict with a claim that something was immediately blocked and contained or that it was detected quickly." publisher: DataBreaches.net - quote: "The Company's Board of Directors has resolved not to comply with criminal extortion demands." publisher: Nayax Ltd. - quote: "The Company's systems have been cleared and based on its investigation to date, confirmed to be free of unauthorized access." publisher: Nayax Ltd. verification: multi-source sourcing_note: > Victim's own SEC Form 6-K is the fact base (victim-disclosure carve-out); DataBreaches.net and Calcalistech corroborate the disclosure and report the extortion claim. The Syndicate's scope figures (1B records / 100TB / ~1yr) are an unverified, uncorroborated leak-site assertion — reported as an attributed claim, not as fact. Nayax's Bank-of-Lithuania payment-institution licence and EEA service scope are cited to Nayax's own licensing announcement. confidence: medium references: [] deep_dive: false deep_dive_category: null org_triage: null classification: reliability: A credibility: 3 watchlist_hit: false actions: - "If you operate or integrate with Nayax terminals/APIs, watch for a material update to the 6-K (initial-access vector, affected cloud provider, and subsidiary are all undisclosed) before drawing conclusions about card-data exposure." - "Audit subsidiary and third-party cloud accounts with access to card-processing data pipelines for anomalous authentication and bulk-export activity (cloud IAM sign-in review, DLP egress alerting on payment-data stores)." updates: - at: "2026-07-16T04:46:00Z" run_id: 2026-07-16T0409Z-intel type: update summary: > In a 2026-07-14 update to its cloud-account incident, Nayax Ltd. (whose Nayax Europe UAB is a Bank-of-Lithuania-licensed EEA payment institution) said its board resolved not to comply with The Syndicate's criminal extortion demand, narrowed the disclosed exfiltrated data to a backup of scanned documents and payment-transaction records that it says exclude sensitive payment authentication data, and confirmed remediation is complete with systems cleared of unauthorized access. The update sharpens the contrast with the group's original — and internally inconsistent — 1-billion-card claim. fields: - evidence - sources - techniques - body merged_from: 2026-07-16/nayax-the-syndicate-board-refuses-extortion-scope-narrowed migrated_from: null --- Nayax Ltd. — an Israeli-headquartered fintech (Nasdaq/Tel Aviv-listed) providing cashless payment terminals and management platforms, and, through Nayax Europe UAB, a Bank-of-Lithuania-licensed payment institution serving more than 23 million enterprises across the EEA ([Nayax, 2018-07-17](https://www.nayax.com/news/payment-institute-license/)) — filed a Form 6-K with the SEC on 2026-07-08 disclosing that it detected "unusual activity" in a cloud account belonging to one of its subsidiaries, which it "immediately blocked and contained" ([Nayax SEC Form 6-K, 2026-07-08](https://www.sec.gov/Archives/edgar/data/1901279/000117891326003440/zk2635660.htm)). Nayax states its production environment and core payment-processing systems were unaffected and business operations continue normally, with the scope still under investigation alongside Israeli and US law enforcement ([DataBreaches.net, 2026-07-08](https://databreaches.net/2026/07/08/nayax-investigating-breach-the-syndicate-claims-it-acquired-1-billion-card-records-and-other-important-data/)). Separately, an extortion group calling itself **"The Syndicate"** posted leak-site claims — surfaced by DataBreaches.net on 2026-07-08 — asserting it acquired more than 1 billion card records, had been inside Nayax's infrastructure for "almost a year", and exfiltrated over 100 TB, with a threatened ~11-day countdown to a public data portal. No evidence has been published for any of these figures, and DataBreaches.net notes the claims are internally inconsistent with Nayax's "immediately blocked and contained" characterisation — a familiar extortion pattern of inflating scope for leverage. Nayax's stock reportedly fell after the claims surfaced, but the company has not confirmed the attacker's figures ([Calcalistech, 2026-07-08](https://www.calcalistech.com/ctechnews/article/rjpeasiqfg)). The filing does not disclose the initial-access vector, the cloud provider, or which subsidiary was involved — a material gap for deriving any concrete detection lever from the disclosure alone. **Defender takeaway:** this is in scope on a European payments-infrastructure nexus — Nayax Europe is a Bank-of-Lithuania-licensed payment institution serving enterprises across the EEA, so any confirmed card-data exposure carries fraud implications for European merchants and cardholders using Nayax terminals. The correct posture right now is to watch for a material 6-K update rather than to action the attacker's unverified figures, and, as due diligence on payment processors generally, to audit subsidiary/third-party cloud accounts with access to card-data pipelines for anomalous sign-ins and bulk exports. Note for analysts running SEC-filing sweeps: Nayax filed as a foreign private issuer via 6-K, not an 8-K Item 1.05 — cybersecurity disclosures from foreign issuers are a blind spot if monitoring only Item 1.05. ## Update — 2026-07-16T04:46:00Z Nayax Ltd. — whose Nayax Europe UAB subsidiary is a Bank-of-Lithuania-licensed payment institution serving EEA enterprises — issued a 14 July status update on the cloud-account incident The Syndicate claimed. Its board of directors "has resolved not to comply with criminal extortion demands," on the stated grounds that compliance would not serve customers', partners', employees' or shareholders' long-term interests ([Nayax Ltd., 2026-07-14](https://www.globenewswire.com/news-release/2026/07/14/3326635/0/en/Nayax-information-security-incident-update.html)). Nayax narrowed the disclosed exfiltrated data to a backup of scanned documents, other business information, and mainly a backup of payment-transaction records that it says excludes sensitive payment-authentication data (cardholder names, CVV, ID information), adding that most affected transactions used digital-wallet single-use tokens it describes as valueless if disclosed. It also states remediation is complete and its systems are confirmed free of unauthorized access ([Nayax Ltd., 2026-07-14](https://www.globenewswire.com/news-release/2026/07/14/3326635/0/en/Nayax-information-security-incident-update.html)). **Defender takeaway:** the operative development is the sharpened gap between the company's account and The Syndicate's original claim of ~1 billion card records with a ~9-month dwell — a claim already flagged as internally inconsistent with an "immediately contained" account. For defenders triaging extortion coverage, this is a reminder to weight a victim's own scoped disclosure over a leak-site actor's volume claims, which are routinely inflated; the reciprocal caution is that "confirmed free of unauthorized access" is a self-assessment pending any actor data release. No new defender action follows from this status update.