13,000 Be-bunk customers affected by a data leak

On 3 March 2026, Be-bunk — a fintech payment provider offering French IBANs, Visa cards and a mobile app to customers across New Caledonia, Wallis and Futuna and French Polynesia — confirmed a data breach affecting roughly 13,000 of its customers. A threat actor using the alias "Spirigatito" claimed responsibility, advertised a database of some 75,358,343 lines (around 200 GB) for sale, and circulated a sample to substantiate the claim.

Be-bunk attributed the incident to a security flaw that it said was "quickly identified and corrected," and stated that technical measures had been taken to secure its systems against further intrusion. The company filed a complaint with authorities in New Caledonia.

The data implicated in the actor's listing covered sensitive financial and personal records, including:

• Names, first names, email addresses and phone numbers
• IBAN account numbers, account balances and fee data
• KYC verification status and politically exposed person (PEP) flags
• Account creation dates, products held and notification tokens

Be-bunk warned customers to be alert to sophisticated phishing attempts, stressing that it would never request account passwords or solicit users via social media, and published dedicated contact numbers for each affected territory. Of the roughly 13,000 customers concerned, a maximum of about 538 were in French Polynesia. The breach is considered contained following remediation, though stolen data was already in circulation at the time of disclosure.