-
A threat actor says it is selling 18 million records tied to Al Salam Bank Seychelles on an underground forum.
-
The alleged data includes transaction logs, partial payment card numbers, and one-time passwords (OTPs), with samples from July 2026.
-
Nobody has confirmed the leak, but analysts warn it could fuel banking scams and account takeover attempts if it is real.
A threat actor says it has a giant bank database for sale on an underground forum. The seller links the data to Al Salam Bank Seychelles. A cybersecurity monitoring account reported the claim on October 19, 2026.
Nobody has proven the claim so far, and the seller’s identity is unconfirmed. Still, security analysts say the data could help scammers target bank customers if it is real.
Seller Offers 18 Million Bank Records on Hacker Forum
A cybersecurity monitoring account named Dark Web Intelligence shared the claim on X. The account posted it on October 19, 2026. It says a threat actor listed a database of 18 million records on an underground forum. The seller tied the listing to Al Salam Bank Seychelles.
According to the report, the database holds customer transaction logs. It also lists partial payment card numbers and internal bank identifiers. One-time passwords (OTPs), which are single-use codes, appear in the list too. The seller also shared samples, and those reportedly show activity from July 2026.
The listing, as described, covers several kinds of bank data. Transaction logs record what customers did with their accounts. Partial card numbers show only some digits of a payment card. Internal bank identifiers are reference codes that banks use inside their own systems.
Al Salam Bank Seychelles is an Islamic financial institution. The Central Bank of Seychelles licenses and regulates it. The bank operates as a subsidiary of Al Salam Bank Bahrain. It offers Sharia-compliant products and services, according to the Seychelles Bankers Association.
Experts Warn the Leak Could Fuel Banking Scams
Security analysts say the data would be a serious risk if the claims are true. Transaction records show how a customer uses their bank account. Criminals could use those details to pose as real bank staff. Their calls and messages would then look more believable. Victims might then share even more private information. A caller who knows a person’s recent payments sounds far more trustworthy. Scammers count on that trust.
Analysts also warn about account takeover attempts. In these attempts, criminals try to gain control of a customer’s bank account. OTP data raises a separate worry about login safety. An OTP is meant to work only once, which is why its status matters.
Surveillance threats extend beyond financial data, as shown by a separate case involving an Israeli ad firm linked to zero-click spyware attacks on Al Jazeera. However, the report does not say whether the codes still work. It also does not say if the codes expired or helped anyone log in. Partial card numbers alone do not let criminals make payments without permission.
The Dark Web Intelligence analyst offered one theory. If the data is real, the mix of transaction records and OTP traffic may point to a hack of card-processing or SMS notification systems. The analyst called this an assessment, not a confirmed finding. These warnings depend on one big condition. The data must be authentic. The report names no entry point, no hacked system, and no attack method.
The report also mentions an earlier claim about the bank’s SMS transaction alerts. That claim surfaced in late September 2026. The report says the new listing may contain data the seller already advertised, rather than a new breach. Nobody has confirmed that link.
No Independent Proof Found for the Leak Claim
A review of public sources found no independent confirmation of the 18 million-record leak. It also found no reliable news coverage that backs the specific claim. The seller’s identity, the samples, and the record count all remain unconfirmed. Nothing shows the data came from the bank’s systems. No verified evidence shows the bank suffered a breach involving this database.
A separate report covered a different case at Seychelles Commercial Bank in July 2025. In that case, the bank confirmed that customers’ personal information was exposed. It also said customer funds were not accessed. That bank is a different institution, so the case offers no evidence against Al Salam Bank Seychelles.
Until more evidence appears, readers should treat the allegation as a threat report, not a confirmed bank breach. This difference matters. A claim on a hacker forum is only an offer to sell. It does not prove a hack happened.
Customers can still take simple steps to stay safe. Review your account activity often, so odd charges stand out early. Contact the bank through its official channels if you spot strange transactions. Never share an OTP with a caller, even one who claims to work for the bank. Do not approve an unexpected login request until you check the transaction behind it. A request you did not start deserves a pause.
The bank’s website and the relevant authorities remain the right places for future updates and advice. Future reports should also keep hacker claims separate from checked facts.
