Baanx Data Breach

Baanx US Corp says intruders accessed Crypto Life user data twice: once in September 2026 and again in October. The data may include Social Security numbers.

Baanx US Corp offers the Crypto Life program, a card program for U.S. users. In a letter dated October 30, 2026, the company said unknown unauthorized parties accessed personal information tied to certain U.S. user accounts.

According to the notice, the access happened between about September 23 and September 28, 2026, and again on or about October 17, 2026. Baanx says the access came through a third-party service provider and through an internal administrative system. The company says the access has been contained.

Baanx also says that, based on its investigation to date, it has found no evidence that customer funds were accessed.

Two Windows of Access, Two Routes In

The notice describes more than one event. The second date falls 19 days after the first window closed. The notice does not explain why access happened again or which route was used on which date.

• September 23 to 28, 2026 (approximately): First window of unauthorized access
• October 17, 2026 (on or about): Second access
• October 30, 2026: Date on the notice letters

The letter does not state how many people were affected. A Vermont filing lists 5 Vermont residents, and the incident also appears on the California Attorney General’s breach list. Those are partial figures, not a total.

What Information Was Exposed?

The notice says the incident may have impacted the following, to the extent a user provided it to Baanx US Corp:

• First and last name
• Date of birth
• Address
• Phone number
• Email address
• Transaction history
• Password (hashed)
• MFA token (in encrypted form)
• Social Security number

Hashing and encryption scramble a password or a login token. They add protection, but Baanx still reset passwords and two-factor authentication for accounts.

Why Crypto Card Users Should Watch for Scams

Transaction history can show that a person holds or spends crypto. Paired with a name, phone number and email address, it could help a scammer write a convincing message. Baanx warns users to be cautious of unexpected emails, calls or messages about their accounts or crypto holdings, and says it will never ask for this sensitive information by email, phone or message.

What Is Baanx Offering?

Baanx is offering 24 months of identity protection and credit monitoring through Experian IdentityWorks at no charge. Enrollment closes January 29, 2027, at experianidworks.com/1Bcreditmembership, using the code in the letter. A credit card is not required.

The response line is 833.918.5929, Monday through Friday, 8:00 a.m. to 8:00 p.m. Central Time.

Your Information Is at Risk

Affected users face a risk of identity theft and targeted phishing. Steps that can reduce the risk include:

• Reset the Crypto Life password and set up two-factor authentication
• Use a password not used anywhere else
• Never share a password, code, recovery phrase or private key
• Enroll in Experian by January 29, 2027
• Check free credit reports at annualcreditreport.com
• Keep the letter and any records of fraud

Do You Have Legal Options?

Financial services companies that collect Social Security numbers are expected to safeguard them. When that does not happen, affected individuals may have legal rights and remedies.

Contact Emery | Reddy today at 916.995.5968 for a Free Case Review. No Fee Unless We Recover.

Your Personally Identifiable Information (PII) includes information that can be used to identify you, such as your name and other personal details. Organizations that collect this information are expected to safeguard it. When PII is exposed in a data breach, it can potentially be used by cybercriminals to commit identity theft, financial fraud, or other misuse.

Residents of California may be entitled to additional protections under the California Consumer Privacy Act (CCPA), which provides enhanced rights regarding the collection, use, and safeguarding of personal information.

FAQ

How many people were affected by the Baanx data breach?

Baanx has not stated a total in its letter. A Vermont filing lists 5 Vermont residents, and that is only one state.

What information was involved?

It may include your name, date of birth, address, phone number, email address, transaction history, hashed password, encrypted MFA token and Social Security number, to the extent you provided them.

Was my crypto or money taken?

Baanx says it has found no evidence that funds were accessed, based on its investigation to date.

Do I need to reset my password?

Baanx says passwords and two-factor authentication were reset. Follow the steps in your letter to regain access, and pick a new password you do not use anywhere else.

Could I get scam messages about this incident?

Yes, that is possible. Be careful with any call, text or email that mentions this incident and asks for personal details, passwords or payment. Use the contact information in your letter.

What should I do if I received a letter?

Consider these steps:

• Keep your letter
• Reset your password and two-factor authentication
• Enroll in Experian by January 29, 2027
• Call 916.995.5968 for a Free Case Review

Do I have a legal claim?

You may have legal rights if your information was involved. Companies have a duty to protect the Social Security numbers and account data they collect. Contact Emery | Reddy at 916.995.5968 or visit www.emeryreddy.com for a Free Case Review. No Fee Unless We Recover.