New
Old crime, new speed. Personal security in 2026: AI, crypto and leaked data.
Our latest report looks at how AI and cryptocurrency change the threats a private person faces.
Download report →
Gart Research
Research for personal security decisions.
To understand how technology is changing personal safety, we keep an open record of personal data leaks and physical attacks to take crypto.
Worried about your own exposure? Talk to a Gart advisor →
Download reports →
Gart Research
Research for personal security decisions.
To understand how technology is changing personal safety, we keep an open record of personal data leaks and physical attacks to take crypto.
Worried about your own exposure? Talk to a Gart advisor →
Download reports →
209leaks on record
117included home addresses
79included national ID numbers
31left through a third-party vendor
40followed by an extortion demand
$200price per customer record paid to bribed staff
Search the leak record →
Leak record as of 19 October 2026.
209leaks on record
117included home addresses
79included national ID numbers
31left through a third-party vendor
40followed by an extortion demand
$200price per customer record paid to bribed staff
Search the leak record →
Leak record as of 19 October 2026.
2 to 3hours for a breach run with AI
< 6 hrsfor an AI agent campaign that took thousands of logins
68%of pseudonymous profiles matched to their owner
1person to build a search engine over tens of millions of leaked records
Sources, in the order of the figures: Anthropic, September 2026 | Google, September 2026 | Lermen et al., February 2026 | Anthropic, September 2026
2 to 3hours for a breach run with AI
< 6 hrsfor an AI agent campaign that took thousands of logins
68%of pseudonymous profiles matched to their owner
1person to build a search engine over tens of millions of leaked records
Sources, in the order of the figures: Anthropic, September 2026 | Google, September 2026 | Lermen et al., February 2026 | Anthropic, September 2026
Physical attacks
48%of cases with a known lead started with a contact or an insider
100through a prior business relationship or trade
59through a friend or acquaintance
30through an insider
5organized by a relative or partner
Data leaks
44data leaks went through bribed, rogue or tricked staff
Known targeting vector in 385 of the 717 cases known to us. In 26% of the total, prior contact or an insider was the lead source. Sources: How physical attacks unfold, record of data leaks.
Physical attacks
48%of cases with a known lead started with a contact or an insider
100through a prior business relationship or trade
59through a friend or acquaintance
30through an insider
5organized by a relative or partner
Data leaks
44data leaks went through bribed, rogue or tricked staff
Known targeting vector in 385 of the 717 cases known to us. In 26% of the total, prior contact or an insider was the lead source. Sources: How physical attacks unfold, record of data leaks.
Ransom and theft that once moved in cash or by bank transfer is moving to bitcoin, stablecoins or digital money.
Online
Online crime involving cryptocurrency
- Investment fraudFalse information persuades people to invest, usually with a promise of large returns at little risk. 61,559 complaints$7.28 billion
- Tech and customer support fraudThe criminal poses as technical or customer support. 17,355 complaints$1.23 billion
- Personal data breachPersonal data is copied, stolen or used by someone with no right to it. 13,486 complaints$939 million
- Confidence and romance fraudA person who believes they are in a relationship is tricked into sending money. 5,925 complaints$395 million
- Employment fraudA person believes they hold a real job and loses money, or launders it for the criminal. 10,338 complaints$288 million
- Government impersonationSomeone poses as a government official to collect or extort money. 5,955 complaints$281 million
- Phishing and spoofingUnsolicited emails, texts and calls made to look like a real company ask for login or financial details. 7,164 complaints$111 million
- ExtortionMoney is demanded under threat of physical harm, prosecution or public exposure. It is the second most reported type. 23,797 complaints$63 million
- RansomwareMalicious software blocks a computer system until money is paid. The FBI calls its own loss figure artificially low, because many organizations report no amount. 902 complaints$17 million
- SIM swapThe criminal persuades a mobile provider to move the victim's number to a phone the criminal holds. 121 complaints$4.4 million
Source: FBI Internet Crime Report 2025
In person
Physical attacks involving cryptocurrency
- KidnappingThe attackers hold a person until the crypto is sent or a ransom is paid.287 cases
- Home invasionThe attackers enter the home while people are inside and force a transfer.191 cases
- Armed robberyThe holder is robbed under threat of a weapon.129 cases
- Robbery without a weaponThe holder is robbed by force or threat, with no weapon reported.63 cases
- BurglaryThe home is entered while nobody is there, to take devices or recovery phrases.31 cases
- Theft by deceptionA meeting arranged under a false pretext is used to take the funds.18 cases
- Express kidnappingA short abduction that ends once the victim has sent what they can reach.12 cases
- Extortion without detentionThreats of violence are used to demand payment, and nobody is held.10 cases
- MuggingThe holder is attacked in the street for what they carry.4 cases
- SwattingA false emergency call sends armed police to the holder's address.2 cases
Source: Gart Research, 2014 to 2026
Ransom and theft that once moved in cash or by bank transfer is moving to bitcoin, stablecoins or digital money.
Online
Online crime involving cryptocurrency
- Investment fraudFalse information persuades people to invest, usually with a promise of large returns at little risk. 61,559 complaints$7.28 billion
- Tech and customer support fraudThe criminal poses as technical or customer support. 17,355 complaints$1.23 billion
- Personal data breachPersonal data is copied, stolen or used by someone with no right to it. 13,486 complaints$939 million
- Confidence and romance fraudA person who believes they are in a relationship is tricked into sending money. 5,925 complaints$395 million
- Employment fraudA person believes they hold a real job and loses money, or launders it for the criminal. 10,338 complaints$288 million
- Government impersonationSomeone poses as a government official to collect or extort money. 5,955 complaints$281 million
- Phishing and spoofingUnsolicited emails, texts and calls made to look like a real company ask for login or financial details. 7,164 complaints$111 million
- ExtortionMoney is demanded under threat of physical harm, prosecution or public exposure. It is the second most reported type. 23,797 complaints$63 million
- RansomwareMalicious software blocks a computer system until money is paid. The FBI calls its own loss figure artificially low, because many organizations report no amount. 902 complaints$17 million
- SIM swapThe criminal persuades a mobile provider to move the victim's number to a phone the criminal holds. 121 complaints$4.4 million
Source: FBI Internet Crime Report 2025
In person
Physical attacks involving cryptocurrency
- KidnappingThe attackers hold a person until the crypto is sent or a ransom is paid.287 cases
- Home invasionThe attackers enter the home while people are inside and force a transfer.191 cases
- Armed robberyThe holder is robbed under threat of a weapon.129 cases
- Robbery without a weaponThe holder is robbed by force or threat, with no weapon reported.63 cases
- BurglaryThe home is entered while nobody is there, to take devices or recovery phrases.31 cases
- Theft by deceptionA meeting arranged under a false pretext is used to take the funds.18 cases
- Express kidnappingA short abduction that ends once the victim has sent what they can reach.12 cases
- Extortion without detentionThreats of violence are used to demand payment, and nobody is held.10 cases
- MuggingThe holder is attacked in the street for what they carry.4 cases
- SwattingA false emergency call sends armed police to the holder's address.2 cases
Source: Gart Research, 2014 to 2026
Cases by year
Purple: 2025, the last full year. Outlined: 2026, year in progress.
717documented cases since 2014
73countries
+43%cases in 2025 against 2024
Confirmed deaths47+in 38 of 717 attacks (5.3%)
Researched attacks
Select one to follow How attacks unfold.
Where the cases happened
Countries with the most cases
Purple: more than 20 cases.
Most recent cases
Cases by year
Purple: 2025, the last full year. Outlined: 2026, year in progress.
717documented cases since 2014
73countries
+43%cases in 2025 against 2024
Confirmed deaths47+in 38 of 717 attacks (5.3%)
Researched attacks
Select one to follow How attacks unfold.
Where the cases happened
Countries with the most cases
Purple: more than 20 cases.
Most recent cases
Loading the cases.
Show relevant cases
Swipe sideways to see all four steps, through to Outcome.
A case can carry more than one label in a step (a lure followed by a fake police stop, for example), so the labels of one step can add up to more than the number of cases. A line joins two labels that occur in the same case, and a thicker line is more cases. Dashed bars mark the gaps in each step: Unknown and Unconfirmed where the sources do not say what happened at that step, and No label fits where they describe an attack none of our labels covers.
Loading the cases.
Show relevant cases
Swipe sideways to see all four steps, through to Outcome.
A case can carry more than one label in a step (a lure followed by a fake police stop, for example), so the labels of one step can add up to more than the number of cases. A line joins two labels that occur in the same case, and a thicker line is more cases. Dashed bars mark the gaps in each step: Unknown and Unconfirmed where the sources do not say what happened at that step, and No label fits where they describe an attack none of our labels covers.
| When | Who | What left | How | Then |
|---|
Loading the record.
What the leak record means for your own accounts, and letters you can send to a provider, are on the #QuestionKYC page.
| When | Who | What left | How | Then |
|---|
Loading the record.
What the leak record means for your own accounts, and letters you can send to a provider, are on the #QuestionKYC page.
You read the evidence
Act on it.
The security of most people and businesses has not caught up. We have no dataset for this claim. It is what we see in our advisory and training work.
Gart app for family & teams
Hold one button to trigger your alert. Your location and your response plan go with it.
Gart app →
Personal OpSec Checklist
A sample of our operational security checklist. Gart Training clients receive the extended version in print.
Download the checklist →
Private advisory
Talk to a Gart advisor
One 90-minute call, on the topics you choose. Or one full day with our trainer.
Advisory & training →
You read the evidence
Act on it.
The security of most people and businesses has not caught up. We have no dataset for this claim. It is what we see in our advisory and training work.
Gart app for family & teams
Hold one button to trigger your alert. Your location and your response plan go with it.
Gart app →Personal OpSec Checklist
A sample of our operational security checklist. Gart Training clients receive the extended version in print.
Download the checklist →
Private advisory
Talk to a Gart advisor
One 90-minute call, on the topics you choose. Or one full day with our trainer.
Advisory & training →
February 2026
Kidnapping, ransom and physical attacks: challenges in cryptocurrency security.
A full analysis of documented physical attacks against cryptocurrency holders: how targets are selected, how incidents unfold, and what changes the outcome. PDF and EPUB.
Download report →
New
Old crime, new speed. Personal security in 2026: AI, crypto and leaked data.
Our latest report looks at how AI and cryptocurrency change the threats a private person faces.
Download report →
February 2026
Kidnapping, ransom and physical attacks: challenges in cryptocurrency security.
A full analysis of documented physical attacks against cryptocurrency holders: how targets are selected, how incidents unfold, and what changes the outcome. PDF and EPUB.
Download report →
For researchers, policy makers and the press
Use the data.
Quote, chart and republish any finding, figure or chart on this page and any record from the two databases, in commercial work too. We ask only that you name the source.
Credit line
Source: gart.io
- The records summarize public reporting. The linked articles belong to their publishers.
- Tell us where you used the data if you can. We read what gets built on it and we correct what you find wrong.
API
- Physical attacks
sqlite-stats2.gart.io/api/cases
Every case as JSON: date, country, location, description, summary, the labels of the four steps and source links. - Data leaks
sqlite-leaks.gart.io/api/leaks
Every published incident as JSON: when, who, what left, how, what followed and source links. - Both answer a plain GET without a key. How attacks unfold visualizes each attack in four steps.
For researchers, policy makers and the press
Use the data.
Quote, chart and republish any finding, figure or chart on this page and any record from the two databases, in commercial work too. We ask only that you name the source.
Credit line
Source: gart.io
- The records summarize public reporting. The linked articles belong to their publishers.
- Tell us where you used the data if you can. We read what gets built on it and we correct what you find wrong.
API
- Physical attacks
sqlite-stats2.gart.io/api/cases
Every case as JSON: date, country, location, description, summary, the labels of the four steps and source links. - Data leaks
sqlite-leaks.gart.io/api/leaks
Every published incident as JSON: when, who, what left, how, what followed and source links. - Both answer a plain GET without a key. How attacks unfold visualizes each attack in four steps.
01
Public sources only
Every entry is a reported incident with a link to its source. We leave out rumors and cases we cannot source.
02
Real numbers are higher
Many attacks and leaks are never reported. We estimate the real numbers are several times what the records show, so read every count here as a minimum.
03
Claims stay claims
Figures are the ones the company, the authorities or the researchers who found the data reported. What an attacker says is marked as a claim.
04
Four steps
We read every physical attack in four steps: targeting, how the attackers chose the victim; approach, how they got to the victim; attack, the type of attack; and outcome, how it ended and what the attackers obtained.
05
Labels
Each step has a fixed set of labels. A case can carry more than one label in a step (a lure followed by a fake police stop, for example), so the labels of one step can add up to more than the number of cases. Where the sources do not say what happened at a step, the case is labeled Unknown.
06
Open to correction
New cases are added as they are reported. If an entry is wrong or a case is missing, write to us and we will check it against the sources.
Report a case or an error →01
Public sources only
Every entry is a reported incident with a link to its source. We leave out rumors and cases we cannot source.
02
Real numbers are higher
Many attacks and leaks are never reported. We estimate the real numbers are several times what the records show, so read every count here as a minimum.
03
Claims stay claims
Figures are the ones the company, the authorities or the researchers who found the data reported. What an attacker says is marked as a claim.
04
Four steps
We read every physical attack in four steps: targeting, how the attackers chose the victim; approach, how they got to the victim; attack, the type of attack; and outcome, how it ended and what the attackers obtained.
05
Labels
Each step has a fixed set of labels. A case can carry more than one label in a step (a lure followed by a fake police stop, for example), so the labels of one step can add up to more than the number of cases. Where the sources do not say what happened at a step, the case is labeled Unknown.
06
Open to correction
New cases are added as they are reported. If an entry is wrong or a case is missing, write to us and we will check it against the sources.
Report a case or an error →Physical attacks
01Targeting
- Data leak
- Customer database, tax-report or exchange leak.
- Public records
- Address or tax records obtained legally.
- Insider
- Someone with inside access (an employee, former employee, driver, guard, contractor, or bank or agency staff) passed on the victim's holdings or movements, or used that access to attack. Also a handler who supplied the target.
- Organized by a relative or partner
- A relative or partner of the victim organized or enabled the attack.
- Acquaintance
- A friend or social contact turned attacker.
- Business counterparty
- Prior trades, investors, a business or debt dispute.
- Public profile
- Known as a crypto holder: interviews, influencer status, executive role, rich lists.
- Social media
- Targeted after specific posts or streams.
- Visible wealth
- Cars, watches, spending or lifestyle seen offline.
- Online contact or advert
- The victim's ad or profile on a platform was answered.
- Surveillance
- Followed, watched, tracked.
- Opportunistic
- No prior selection.
- Other
- Anything else.
- Unknown
- The sources do not say how the victim was chosen.
Was the attackers' information right?
- Correct
- The victim held crypto or assets roughly as the attackers believed.
- Wealth overestimated
- The victim held far less than the attackers believed, or none.
- Wrong person or address
- The attackers hit someone other than the intended holder (moved out, previous owner, namesake).
- Unknown
- The sources do not let us tell.
02Approach
- Social engineering: business or investment meeting
- Social engineering: sale / purchase lure
- A sale or purchase of something other than crypto.
- Social engineering: dating or sexual lure
- Social engineering: social invitation
- Friend, party, dinner, night out.
- Social engineering: pretext at the door
- A story told at the door with no claimed role (damage to report, asking for someone).
- Social engineering: other pretext
- Social engineering: lure not described
- The sources say the victim was lured and not how.
- P2P trade
- Any arranged meeting to exchange crypto or cash, whether or not the other side meant to trade.
- Authority misuse: fake police or official
- Authority misuse: serving police or official
- Authority misuse: service ruse (delivery, driver, worker)
- Includes fake taxis, fake rideshare and fake deliveries.
- Authority misuse: other claimed role
- Seized in the street or a public place
- Seized at or outside the home
- Grabbed at the door, gate, garage or car park of the home, without entry.
- Taken from the workplace
- Vehicle intercepted on the road
- Walked in
- Into a shop, exchange office or ATM site open to the public.
- Forced entry
- Into a home, hotel room, office or shop.
- Let in by an insider
- Break-in, nobody present
- Remote, no contact
- Unknown
- The sources do not say how the attackers got to the victim.
Who was attacked
Counted in people. A case can name more than one person.
- Holder
- The person believed to hold the crypto or assets.
- Relative or partner
- Family or partner of the holder, attacked alongside the holder, as leverage, or in the holder's place. A couple or family attacked together is holder plus relative or partner.
- Employee or guard
- Staff of the holder or of a crypto business.
- Wrong person or address
- Someone attacked in place of the intended holder, usually because the attackers had an outdated address (previous owner or tenant).
- Bystanders or neighbors
- Others present who were not family or staff of the holder: friends, co-occupants, a neighbor, a passenger, customers in a shop.
- Other
- A person the other groups do not cover, or the sources do not say who it was.
03Attack
- Kidnapping
- The victim is taken away or held at a place the attackers control; pre-selected, or ransom asked of third parties.
- Express kidnapping
- Not pre-selected, seized in public, made to pay from own funds on the spot or in a vehicle. All three are needed.
- Home invasion
- Occupants held in their own home, hotel room or office.
- Armed robbery
- Theft by force with a weapon, no extended holding.
- Robbery without a weapon
- Theft by force or assault, no weapon reported.
- Mugging
- Opportunistic street robbery.
- Burglary
- Theft from premises, a machine or an empty home, nobody confronted.
- Extortion without detention
- Threats in person or remote, nobody held.
- Theft by deception
- No force used.
- Swatting
- A false emergency report sends armed police to the victim.
- No label fits
- The sources describe an attack none of our labels covers.
Violence used
- Detention
- Anyone was held against their will, restrained or prevented from leaving, for any length of time: the holder, a relative, staff or a guard.
- Violence or torture
- Physical violence against a person: beaten, stabbed, shot, burned, tasered or tortured, or injured in the attack. Restraint is detention, a weapon only carried is weapons, and drugging is drugs or alcohol.
- Weapons
- A weapon was present or used: a firearm, knife, taser, pepper spray, or any object used as a weapon, a car included. Fists do not count, and neither do ties or tape used only to tie someone up.
- Drugs or alcohol
- The attackers used a drug or alcohol on the victim: a spiked drink, a sedative, an injection or forced drinking. The victim's own drinking does not count.
Values of violence used
Each of the four takes one value. The four steps count Yes only.
- Yes
- The sources report it as fact.
- No
- It surely did not happen: the sources say so, or the account rules it out (nobody was present).
- Threat only
- Violence or torture only. Threats of harm were made, such as a weapon pointed or a threat against the family, and no physical violence is reported.
- Unconfirmed
- A source asserts, alleges or charges it, or the sources disagree, and it is not established.
- Unknown
- The sources do not say, or say it was not disclosed. A flag the sources are silent on is Unknown, never No.
04Outcome
- Foiled
- Stopped before the attackers gained control of anyone. An attack that got no assets after holding or hurting someone is not foiled; see what the attackers obtained.
- Escaped
- The victim got away from the attackers by their own action (ran, jumped, slipped away).
- Fought off
- The victim, or someone with them, resisted physically and the attackers gave up and fled.
- Rescued
- Freed by police or other people.
- Released
- The attackers let the victim go, or left.
- Killed
- The victim died.
- Victim missing
- The victim has not been found, and neither a death nor a release is confirmed.
- Nobody held or hurt
- Burglary, swatting, remote cases.
- Unknown
- The sources do not say what happened at this step.
What the attackers obtained
- Crypto
- Cash
- Devices or seed
- Valuables
- Nothing
- Unconfirmed
- A taking is alleged or charged and not established, or the sources disagree.
- Unknown
- The sources do not say what, if anything, the attackers got.
Data leaks
The labels of each leak. A leak can carry more than one data and aftermath label.
Who held the data
Sector
- Finance
- Banks, payment and money transfer firms, brokers, investment platforms, wealth managers, lenders, credit bureaus and insurers.
- Identity vendors
- Companies that verify identity for other companies.
- Government
- Public bodies, registers, tax offices and police.
- Crypto
- Exchanges, wallet makers, crypto ATMs, on-ramps and their vendors.
- Luxury
- Luxury retailers, fashion houses, jewellers, auction houses and makers of luxury cars.
- Other
- Any other holder of personal data.
Verification
- Confirmed
- The holder or a public authority confirmed the incident.
- Reported
- Reported by a named publication or researcher; the holder has not confirmed or has said little.
- Claimed
- Rests on what the attacker or seller says. The text marks the figures as a claim.
- Disputed
- The named holder denies that the data is its own or that it was breached. The text carries the denial.
How the data left
Leak type
- Theft
- An outsider took the data: intrusion, stolen credentials, a breach at a vendor, or staff tricked into giving access.
- Handover
- The holder released the data itself to a requester who was not who they claimed to be: a fraudulent emergency data request, a forged subpoena or court order, a fake regulator or auditor.
- Insider
- A person with legitimate access (employee, former employee, contractor) copied, sold or passed on the data.
- Exposure
- The data was left reachable without a break-in: an open database, a public storage bucket, a misdirected export.
- Compilation
- A file assembled from earlier leaks and offered as one set.
- Unknown
- The sources do not say how the data left.
Vector
- Fake legal request
- Fraudulent emergency data request (EDR), forged subpoena, warrant or court order, usually sent from a compromised police or government mailbox.
- Pretexting
- Staff talked into releasing data or access by someone posing as a customer, colleague or supplier: voice phishing, support-desk social engineering.
- Bribed insider
- Staff or a contractor paid by an outsider to copy records.
- Rogue insider
- Staff, former staff or a contractor acting on their own, including access that was never revoked.
- Third party
- The data left through a vendor or processor (support desk, email, shipping, e-commerce, banking, claims), or through the holder's account at that vendor.
- Open storage
- A database or storage bucket readable from the internet without a password.
- Software flaw
- A vulnerability in the holder's own systems or in software it runs.
- Account takeover
- Stolen or guessed credentials, access tokens or API keys used to log in, including a SIM swap of a staff phone number.
- Compilation
- Assembled from earlier leaks.
- Undisclosed
- The sources do not say.
What left
Data in the leak
- Name
- Full name.
- Address
- Home, postal or shipping address.
- Location
- Coarser than an address: city, ZIP code, country of residence.
- Date of birth
- Date of birth.
- Phone
- Phone number.
- Email address.
- ID document
- Image or scan of a passport, identity card or driving license.
- Selfie
- Verification selfie, video or other biometric capture.
- National ID number
- Social security, tax or national identity number, in full or in part.
- Nationality
- Nationality or citizenship.
- Family
- Details of a spouse, children or other relatives.
- Bank account
- Bank account, routing or card numbers.
- Account ID
- Customer, membership or account number at the holder.
- Balance
- Account balance or a snapshot of holdings at the provider.
- Transactions
- Statements or transaction history.
- Wallet
- Wallet addresses, extended public keys, device serials, or proof that a person owns a hardware wallet.
- Wealth
- Income, tax, ownership or other financial details held outside an account.
- Order history
- What the person bought and when.
- Messages
- Private messages or support tickets.
- IP address
- IP address or device identifiers.
- Credentials
- Passwords, password hashes, seeds or 2FA secrets.
- Employment
- Employer, job title or HR records.
What followed
Aftermath
- Sale
- Offered for sale.
- Publication
- Published or dumped.
- Extortion
- A ransom or extortion demand to the holder or to the people in the data.
- Phishing
- Phishing or scam attempts that used the data.
- Impersonation
- The holder or its staff were impersonated to the people in the data.
- Physical threat
- Threats of a visit or of violence that used the data.
- Physical attack
- A documented attack on a person that used the data.
Physical attacks
01Targeting
- Data leak
- Customer database, tax-report or exchange leak.
- Public records
- Address or tax records obtained legally.
- Insider
- Someone with inside access (an employee, former employee, driver, guard, contractor, or bank or agency staff) passed on the victim's holdings or movements, or used that access to attack. Also a handler who supplied the target.
- Organized by a relative or partner
- A relative or partner of the victim organized or enabled the attack.
- Acquaintance
- A friend or social contact turned attacker.
- Business counterparty
- Prior trades, investors, a business or debt dispute.
- Public profile
- Known as a crypto holder: interviews, influencer status, executive role, rich lists.
- Social media
- Targeted after specific posts or streams.
- Visible wealth
- Cars, watches, spending or lifestyle seen offline.
- Online contact or advert
- The victim's ad or profile on a platform was answered.
- Surveillance
- Followed, watched, tracked.
- Opportunistic
- No prior selection.
- Other
- Anything else.
- Unknown
- The sources do not say how the victim was chosen.
Was the attackers' information right?
- Correct
- The victim held crypto or assets roughly as the attackers believed.
- Wealth overestimated
- The victim held far less than the attackers believed, or none.
- Wrong person or address
- The attackers hit someone other than the intended holder (moved out, previous owner, namesake).
- Unknown
- The sources do not let us tell.
02Approach
- Social engineering: business or investment meeting
- Social engineering: sale / purchase lure
- A sale or purchase of something other than crypto.
- Social engineering: dating or sexual lure
- Social engineering: social invitation
- Friend, party, dinner, night out.
- Social engineering: pretext at the door
- A story told at the door with no claimed role (damage to report, asking for someone).
- Social engineering: other pretext
- Social engineering: lure not described
- The sources say the victim was lured and not how.
- P2P trade
- Any arranged meeting to exchange crypto or cash, whether or not the other side meant to trade.
- Authority misuse: fake police or official
- Authority misuse: serving police or official
- Authority misuse: service ruse (delivery, driver, worker)
- Includes fake taxis, fake rideshare and fake deliveries.
- Authority misuse: other claimed role
- Seized in the street or a public place
- Seized at or outside the home
- Grabbed at the door, gate, garage or car park of the home, without entry.
- Taken from the workplace
- Vehicle intercepted on the road
- Walked in
- Into a shop, exchange office or ATM site open to the public.
- Forced entry
- Into a home, hotel room, office or shop.
- Let in by an insider
- Break-in, nobody present
- Remote, no contact
- Unknown
- The sources do not say how the attackers got to the victim.
Who was attacked
Counted in people. A case can name more than one person.
- Holder
- The person believed to hold the crypto or assets.
- Relative or partner
- Family or partner of the holder, attacked alongside the holder, as leverage, or in the holder's place. A couple or family attacked together is holder plus relative or partner.
- Employee or guard
- Staff of the holder or of a crypto business.
- Wrong person or address
- Someone attacked in place of the intended holder, usually because the attackers had an outdated address (previous owner or tenant).
- Bystanders or neighbors
- Others present who were not family or staff of the holder: friends, co-occupants, a neighbor, a passenger, customers in a shop.
- Other
- A person the other groups do not cover, or the sources do not say who it was.
03Attack
- Kidnapping
- The victim is taken away or held at a place the attackers control; pre-selected, or ransom asked of third parties.
- Express kidnapping
- Not pre-selected, seized in public, made to pay from own funds on the spot or in a vehicle. All three are needed.
- Home invasion
- Occupants held in their own home, hotel room or office.
- Armed robbery
- Theft by force with a weapon, no extended holding.
- Robbery without a weapon
- Theft by force or assault, no weapon reported.
- Mugging
- Opportunistic street robbery.
- Burglary
- Theft from premises, a machine or an empty home, nobody confronted.
- Extortion without detention
- Threats in person or remote, nobody held.
- Theft by deception
- No force used.
- Swatting
- A false emergency report sends armed police to the victim.
- No label fits
- The sources describe an attack none of our labels covers.
Violence used
- Detention
- Anyone was held against their will, restrained or prevented from leaving, for any length of time: the holder, a relative, staff or a guard.
- Violence or torture
- Physical violence against a person: beaten, stabbed, shot, burned, tasered or tortured, or injured in the attack. Restraint is detention, a weapon only carried is weapons, and drugging is drugs or alcohol.
- Weapons
- A weapon was present or used: a firearm, knife, taser, pepper spray, or any object used as a weapon, a car included. Fists do not count, and neither do ties or tape used only to tie someone up.
- Drugs or alcohol
- The attackers used a drug or alcohol on the victim: a spiked drink, a sedative, an injection or forced drinking. The victim's own drinking does not count.
Values of violence used
Each of the four takes one value. The four steps count Yes only.
- Yes
- The sources report it as fact.
- No
- It surely did not happen: the sources say so, or the account rules it out (nobody was present).
- Threat only
- Violence or torture only. Threats of harm were made, such as a weapon pointed or a threat against the family, and no physical violence is reported.
- Unconfirmed
- A source asserts, alleges or charges it, or the sources disagree, and it is not established.
- Unknown
- The sources do not say, or say it was not disclosed. A flag the sources are silent on is Unknown, never No.
04Outcome
- Foiled
- Stopped before the attackers gained control of anyone. An attack that got no assets after holding or hurting someone is not foiled; see what the attackers obtained.
- Escaped
- The victim got away from the attackers by their own action (ran, jumped, slipped away).
- Fought off
- The victim, or someone with them, resisted physically and the attackers gave up and fled.
- Rescued
- Freed by police or other people.
- Released
- The attackers let the victim go, or left.
- Killed
- The victim died.
- Victim missing
- The victim has not been found, and neither a death nor a release is confirmed.
- Nobody held or hurt
- Burglary, swatting, remote cases.
- Unknown
- The sources do not say what happened at this step.
What the attackers obtained
- Crypto
- Cash
- Devices or seed
- Valuables
- Nothing
- Unconfirmed
- A taking is alleged or charged and not established, or the sources disagree.
- Unknown
- The sources do not say what, if anything, the attackers got.
Data leaks
The labels of each leak. A leak can carry more than one data and aftermath label.
Who held the data
Sector
- Finance
- Banks, payment and money transfer firms, brokers, investment platforms, wealth managers, lenders, credit bureaus and insurers.
- Identity vendors
- Companies that verify identity for other companies.
- Government
- Public bodies, registers, tax offices and police.
- Crypto
- Exchanges, wallet makers, crypto ATMs, on-ramps and their vendors.
- Luxury
- Luxury retailers, fashion houses, jewellers, auction houses and makers of luxury cars.
- Other
- Any other holder of personal data.
Verification
- Confirmed
- The holder or a public authority confirmed the incident.
- Reported
- Reported by a named publication or researcher; the holder has not confirmed or has said little.
- Claimed
- Rests on what the attacker or seller says. The text marks the figures as a claim.
- Disputed
- The named holder denies that the data is its own or that it was breached. The text carries the denial.
How the data left
Leak type
- Theft
- An outsider took the data: intrusion, stolen credentials, a breach at a vendor, or staff tricked into giving access.
- Handover
- The holder released the data itself to a requester who was not who they claimed to be: a fraudulent emergency data request, a forged subpoena or court order, a fake regulator or auditor.
- Insider
- A person with legitimate access (employee, former employee, contractor) copied, sold or passed on the data.
- Exposure
- The data was left reachable without a break-in: an open database, a public storage bucket, a misdirected export.
- Compilation
- A file assembled from earlier leaks and offered as one set.
- Unknown
- The sources do not say how the data left.
Vector
- Fake legal request
- Fraudulent emergency data request (EDR), forged subpoena, warrant or court order, usually sent from a compromised police or government mailbox.
- Pretexting
- Staff talked into releasing data or access by someone posing as a customer, colleague or supplier: voice phishing, support-desk social engineering.
- Bribed insider
- Staff or a contractor paid by an outsider to copy records.
- Rogue insider
- Staff, former staff or a contractor acting on their own, including access that was never revoked.
- Third party
- The data left through a vendor or processor (support desk, email, shipping, e-commerce, banking, claims), or through the holder's account at that vendor.
- Open storage
- A database or storage bucket readable from the internet without a password.
- Software flaw
- A vulnerability in the holder's own systems or in software it runs.
- Account takeover
- Stolen or guessed credentials, access tokens or API keys used to log in, including a SIM swap of a staff phone number.
- Compilation
- Assembled from earlier leaks.
- Undisclosed
- The sources do not say.
What left
Data in the leak
- Name
- Full name.
- Address
- Home, postal or shipping address.
- Location
- Coarser than an address: city, ZIP code, country of residence.
- Date of birth
- Date of birth.
- Phone
- Phone number.
- Email address.
- ID document
- Image or scan of a passport, identity card or driving license.
- Selfie
- Verification selfie, video or other biometric capture.
- National ID number
- Social security, tax or national identity number, in full or in part.
- Nationality
- Nationality or citizenship.
- Family
- Details of a spouse, children or other relatives.
- Bank account
- Bank account, routing or card numbers.
- Account ID
- Customer, membership or account number at the holder.
- Balance
- Account balance or a snapshot of holdings at the provider.
- Transactions
- Statements or transaction history.
- Wallet
- Wallet addresses, extended public keys, device serials, or proof that a person owns a hardware wallet.
- Wealth
- Income, tax, ownership or other financial details held outside an account.
- Order history
- What the person bought and when.
- Messages
- Private messages or support tickets.
- IP address
- IP address or device identifiers.
- Credentials
- Passwords, password hashes, seeds or 2FA secrets.
- Employment
- Employer, job title or HR records.
What followed
Aftermath
- Sale
- Offered for sale.
- Publication
- Published or dumped.
- Extortion
- A ransom or extortion demand to the holder or to the people in the data.
- Phishing
- Phishing or scam attempts that used the data.
- Impersonation
- The holder or its staff were impersonated to the people in the data.
- Physical threat
- Threats of a visit or of violence that used the data.
- Physical attack
- A documented attack on a person that used the data.
Working on a story or a study?
We answer data requests and interview requests within 24 hours.
Working on a story or a study?
We answer data requests and interview requests within 24 hours.
Stealth. Ready. Smart.
A personal risk management app and private advisory for founders, executives, investors and their families. Built by people working in cryptography, digital and physical security and continuity of operations.