CitizensPay Listed by Dysphor1a Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

In the current ransomware economy, extortion groups routinely publish victim names on leak sites before any independent verification occurs. Listings often mix real intrusions with recycled claims, inflated inventories, and countdown timers designed to pressure payment. One such listing names CitizensPay, a Myanmar digital wallet also known as CTZPay, and attributes the claim to the group Dysphor1a.

As of writing, CitizensPay has not publicly confirmed the claim. What is known is limited to what appears on the group's leak-site material: a claim of roughly 30 GB of material, a stated focus on agent user information, an asking price range, and a short countdown. People affected and exact data categories beyond that marketing language remain undisclosed. For customers, agents, and partners, the practical question is not whether a countdown looks dramatic, but what a leak-site claim does and does not establish—and what to do if personal or business data later proves to have been involved.

What the listing says

According to material associated with Dysphor1a's leak site, CitizensPay (also referred to as CTZPay and linked in the listing to the domain ctzpay.com) was listed around 5 September 2026. The listing places the organisation in Myanmar and describes it as a digital wallet and payment platform. It claims a data volume of about 30 GB and refers to “compromised agent user information.” A price range of $7,000 to $25,000 and a countdown timer (reported in the source material as on the order of two days remaining at the time of capture) also appear in the listing language.

The listing does not provide a verified count of individuals affected. It does not publish a confirmed inventory of file types, fields, or systems. Method of access, dwell time, and whether any files were actually exfiltrated are not established in the available claim text. Public detail is therefore limited to the group's assertions: sector label, country, approximate size, agent-user framing, ransom-style pricing, and victim naming. CitizensPay has not, as of writing, publicly confirmed that a breach occurred or that the listed description is accurate.

Inside Dysphor1a

Dysphor1a is known in open reporting as a ransomware and data-extortion style actor that uses leak-site pressure: name a victim, assert that data was taken, display a timer, and threaten publication or sale if payment is not made. Like other groups in this category, it typically blends technical intrusion claims with commercial messaging aimed at forcing a response from the named organisation and drawing attention from customers and the press.

Well-documented patterns among such crews include double-extortion narratives (encryption plus alleged data theft), staged “proof” samples that may or may not represent full datasets, and listings that can exaggerate volume or sensitivity. None of that general pattern proves what happened in any single case. For this listing, the only incident-specific statements that can be repeated are those the group itself put forward: that CitizensPay appears on its site, that it claims roughly 30 GB tied to agent user information, and that it advertised a five-figure dollar range. Those remain claims, not adjudicated findings.

About CitizensPay

CitizensPay, also known as CTZPay, is described in public-facing and listing language as a mobile digital wallet and payment platform in Myanmar, associated with Myanmar Citizens Bank (MCB) and Capital Connect Limited. Services of this kind typically sit between banks, merchants, agents, and end users: account onboarding, balance and transfer flows, merchant or agent networks, and customer support channels.

A leak-site claim against a payment wallet matters because such platforms sit close to identity, transaction, and distribution networks even when a specific breach is unconfirmed. Agent networks in particular often involve onboarding records, contact details, and operational credentials that, if misused, can affect both the platform's users and the wider cash-in/cash-out ecosystem. That consequence follows from the sector's role, not from any verified conclusion that CitizensPay's systems were compromised.

What was likely exposed

The facts available from the listing do not disclose a confirmed catalogue of data types. The group's own wording refers to agent user information and a total claimed size of about 30 GB. Exact fields, whether customer wallets were included, and whether financial credentials or full transaction histories were involved are unconfirmed.

If files of the kind payment and agent platforms commonly hold were taken, organisations in this sector typically retain some mix of the following—again conditional, not established for this case:

• Agent or merchant registration details (names, business identifiers, contact numbers, addresses)
• Account or wallet identifiers linked to onboarding
• Internal user or operator directory information
• Support, KYC-related, or compliance documents depending on local rules
• Operational logs or exports that can contain personal data when poorly scoped

None of the above should be read as an inventory of what Dysphor1a holds. People affected remain unknown. Treat any later dump or sample as something to verify against official notices, not against extortion marketing alone.

Why it matters

For individuals and agents, the real-world risk if agent-related or customer-adjacent data were involved is practical rather than theatrical: targeted phishing that references the wallet brand, social engineering of agents who handle cash and customer onboarding, account-takeover attempts, and secondary fraud using contact details. In markets where mobile wallets are a primary payment rail, even partial agent directories can be reused to impersonate support staff or to map who sits where in the distribution chain.

For the organisation, a public leak-site listing creates reputational and operational pressure whether or not the underlying claim is fully accurate. Customers and partners may seek clarification; regulators and banks in the ecosystem may ask questions; and copycat scams often spike after a name appears on an extortion page. What the listing does establish is that Dysphor1a chose to name CitizensPay and to attach size, price, and agent-user language. What it does not establish is confirmed theft, confirmed population counts, or confirmed file contents. Separating those two layers is the core of a careful reading.

What to do now

If you use CitizensPay/CTZPay or work as an agent or merchant in its network, proceed on a conditional basis: act as you would when a credible claim surfaces, without assuming your records are already public. Watch for official statements from the company or from Myanmar Citizens Bank channels you already trust. Treat unsolicited messages that cite a “breach,” demand urgent wallet transfers, or ask for PINs and one-time codes as likely scams. Prefer in-app or known-bank contact paths over links sent by strangers. If you reuse passwords across financial apps, change the wallet-related password and enable the strongest available login protections. Monitor accounts for unfamiliar devices, agents acting in your name, or transfers you did not initiate. Keep records of suspicious contacts.

Readers who want a baseline check can run a free exposure scan of their email to see whether that address has already appeared in known breach datasets unrelated to this claim. That kind of check does not prove or disprove the Dysphor1a listing; it only helps you see whether your email is already circulating in older corpora so you can prioritise password hygiene and alertness. Until CitizensPay or a competent authority confirms otherwise, the responsible posture is simple: treat the leak-site post as an unverified accusation, reduce phishing and credential risk, and follow primary-source updates rather than countdown timers.

AICompiled with AI assistance from public sources and published under our editorial standards.