cashbackAPP Listed by malas Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On April 09, 2023, the organisation cashbackAPP was listed by the ransomware group known as malas. Public reporting states that the incident involved the use of a Zimbra vulnerability and the exfiltration of internal files in a ransomware attack. The number of people affected remains unknown, and wider confirmed detail is limited.

Listings of this kind matter because they signal a claimed compromise that could place internal material and any associated personal or operational data at risk. Until more is verified, the core facts are the listing itself, the reported date, the named method, and the description of internal files taken.

Breaking down the breach

According to the available record, cashbackAPP appeared on a malas listing dated April 09, 2023. The reported summary indicates the attackers used a Zimbra vulnerability. Zimbra is widely deployed collaboration and email software; exploitation of known flaws in such platforms is a documented route into organisational networks, though the precise technical path, timing of initial access, and full scope of activity in this case are not publicly detailed beyond that summary.

The record describes internal files as having been exfiltrated in a ransomware attack. No figure is given for the volume of data, no file inventory is published in the facts, and the number of people affected is listed as unknown. Whether encryption was deployed alongside theft, whether systems were disrupted, and whether the organisation has confirmed or contested the claim are not stated in the available information. The incident is therefore known primarily through the group’s listing and the brief accompanying description rather than through a full independent technical disclosure.

The group behind it: malas

Malas is identified in the record as a ransomware group. Groups operating under this model typically gain access to networks, move laterally, exfiltrate data, and then threaten publication or further harm unless demands are met. They commonly advertise victims on leak sites to apply pressure. Public reporting on such actors often notes the use of known software vulnerabilities, stolen credentials, or other initial-access methods, followed by data theft framed as leverage.

In this instance, the group claims cashbackAPP as a victim and associates the activity with a Zimbra vulnerability and the exfiltration of internal files. That listing should be treated as a claim by the group rather than as independently confirmed fact unless and until the organisation or other authoritative sources verify it. No additional statements attributed to malas about this specific victim—such as ransom amounts, deadlines, or sample file releases—are included in the facts provided.

cashbackAPP and its sector

cashbackAPP operates in the cashback and consumer-rewards space. Organisations of this type typically provide users with rebates, points, or financial incentives tied to purchases, often through apps or web platforms linked to retail and payment activity. As a result they commonly hold account identifiers, contact details, transaction or redemption records, and related operational data needed to run rewards programmes.

A breach affecting such an organisation is consequential because the data environment sits at the intersection of consumer finance and everyday retail behaviour. Even when only “internal files” are named, those files can include materials that support customer operations, partner arrangements, or system configuration. Disruption or exposure in this sector can affect user trust, regulatory obligations around personal data, and the integrity of financial-incentive systems that people rely on for everyday spending.

What data was at risk

The facts name the exposed material as internal files exfiltrated in a ransomware attack. No further breakdown—such as customer databases, credentials, financial records, or employee information—is supplied. The number of people affected is unknown, and exact contents remain unconfirmed.

Organisations in the cashback and rewards sector typically hold data that can include user account details, email addresses, phone numbers, transaction or cashback histories, payment-related tokens or references, and internal business documents. It is not established that any specific category beyond “internal files” was taken in this incident. Readers should therefore treat the precise composition of the stolen set as undisclosed rather than assume a full customer-data dump or any other particular inventory.

Why it matters

For individuals, the real-world risk depends on what the internal files actually contained. If personal or account data were included, possible outcomes include unwanted contact, phishing that references genuine account activity, or attempts to reuse credentials elsewhere. If the material was purely operational, direct consumer harm may be lower, yet secondary risks—such as attackers learning how systems work—can still arise. Because the affected population size is unknown, it is not possible to gauge how widely any personal impact extends.

For the organisation, a claimed ransomware incident with exfiltration raises issues of operational continuity, regulatory notification duties where personal data is involved, and reputational strain with users and partners. The reported use of a Zimbra vulnerability also underscores the broader exposure that internet-facing collaboration tools can create when patches or access controls lag. None of this establishes negligence as fact; it simply describes why such events carry weight for both the people whose data may be involved and the entity that holds it.

Were you affected?

If you have used cashbackAPP or related services, practical steps focus on reducing follow-on risk while public detail remains limited. Consider the following:

• Monitor account activity and statements for unfamiliar redemptions, changes, or messages that reference your cashback history.
• Change passwords on the service and on any other accounts where you reused the same credentials; enable multi-factor authentication where available.
• Treat unsolicited emails, texts, or calls that claim to relate to this incident with caution—verify through official channels rather than links or attachments in the message.
• Watch for phishing that uses realistic details about rewards or transactions to request logins or payment information.

You can also run a free exposure scan of your email address to check whether your information has already surfaced in known breach data sets. That check does not confirm or rule out involvement in this specific incident, but it can help you see whether your address appears in previously compiled breach collections and prioritise further protections accordingly.

AICompiled with AI assistance from public sources and published under our editorial standards.