AYA BANK Listed by lapsus$ Ransomware Group: Ransomware Claim — What’s Alleged & What To Do
AYA BANK has been listed by the lapsus$ ransomware group following the exfiltration of internal files. The listing was reported on June 23, 2026; the number of people affected remains undisclosed.
On June 23, 2026, the ransomware group lapsus$ listed AYA BANK on its leak site. The group claims to hold internal files from the bank’s main platform, described as a full dump that includes personally identifiable information, and states it will begin selling the material if the bank does not make contact or pay a ransom. No independent confirmation of the data’s volume, contents, or authenticity has been made public, and the number of individuals potentially affected remains unknown.
What happened
The only confirmed public record of the incident is the listing itself. lapsus$ posted a notice asserting that it had exfiltrated internal files during a ransomware operation against AYA BANK. The post indicates that the material covers the bank’s primary platform and contains PII, with a threat to sell the data if demands are not met. No further details on the date or method of the intrusion, the quantity of records, or any encryption of systems have been disclosed by the bank or by investigators.
Who is lapsus$?
lapsus$ is a ransomware group that has conducted operations against corporate and government targets in multiple countries. Public reporting on the group’s prior activity shows a pattern of data exfiltration followed by ransom demands and, in some cases, public leaks when payment is not received. The group’s listings are treated as claims until corroborated by the affected organization or by law-enforcement findings.
AYA BANK and its sector
AYA BANK operates in the financial-services sector. Organizations of this type routinely maintain customer account records, transaction histories, identification documents, and internal operational systems. A claimed compromise of such an institution raises questions about the security of financial data and the potential downstream effects on customers and counterparties, even when the precise scope of any exposure is still unconfirmed.
The information in question
The listing refers to “internal files” and a “full dump” that purportedly includes PII. No verified inventory of the data has been released, and the bank has not published a statement confirming or denying the claims. In the absence of an official disclosure, the exact categories and volume of records remain unconfirmed.
Why it matters
Financial institutions hold data that can be used for identity fraud, account takeover, or targeted scams. Even without Reported Details on the number of records involved, any verified exfiltration from a bank can create long-term monitoring obligations for customers and regulatory scrutiny for the institution. The absence of public confirmation leaves both the scale of risk and the appropriate response measures unclear.
Were you affected?
Individuals who hold accounts or have shared personal information with AYA BANK should monitor their financial statements and credit reports for unusual activity. Organizations that provide free breach-exposure checks allow users to enter an email address and review whether it appears in previously published data sets; running such a scan provides one practical starting point while awaiting any official notification from the bank.
AICompiled with AI assistance from public sources and published under our editorial standards.
How this breach connects
More recent breaches
MAPFRE ASSURANCE Listed by lapsus$ Ransomware GroupGITHUB INTERNAL Listed by lapsus$ Ransomware GroupIngka Group (IKEA) Targeted in Alleged Lapsus$ Data TheftMERCOR Listed by lapsus$ Ransomware GroupLatest breaches
Read GalaxyWarden’s full analysis of the AYA BANK Listed by lapsus$ Ransomware Group →
Publicly posted by lapsus — unverified claim, pending independent verification
Breach listings — particularly those originating from ransomware or leak sites — are third-party claims that may be unverified, incomplete, or inaccurate. A listing does not by itself confirm that a breach occurred or that any specific data was exposed. Severity is an automated assessment, not a definitive rating. Verification status is shown where available.
Attributions to threat groups and methods reflect public reporting and, in some cases, unverified claims made by the groups themselves; they may be incomplete or later revised. Recent Breaches and GalaxyWarden are independent and are not affiliated with, and do not endorse, any company or group named on this page. This information is aggregated from public sources for awareness only and is not legal, security, or investment advice.