Skip to content
Leak-site post naming lopay, captured by ThreatCluster

lopay

black x

Ransomware leak-site victim intelligence · EN

Posted
Oct 9, 2026
Country
GB
Industry
Financial Services

What was taken

UK-based fintech company providing a payment platform for SMEs and sole traders to accept payments and manage settlements.

Data categories
PIIFinancial dataTransaction historyBanking dataCard informationPayment terminal informationCustomer payment details
Sample files (1)
lopay_map.txt

Leak-site images (7)

Images from the victim's leak listing. Thumbnails scraped from the onion page are blurred by default — click a thumbnail to view.

ThreatCluster capture
Directory listing of files including CSV and JSON formats, with file names related to payments and user data.
onion leak page325 KB
Directory listing of JSON files related to sales data, with file names including various merchant summaries and volumes.
onion leak page426 KB
Screenshot of a code snippet containing JSON data with various attributes and values, including a watermark labeled "BlackX."
onion leak page1.4 MB
Receipt from a grocery store listing various items purchased, including fruit salad, melon medley, and wine gums, with a total amount due.
onion leak page744 KB
The image contains a screenshot of a JSON-like data structure with various fields, including names, emails, and other personal information, overlaid with a watermark.
onion leak page1.3 MB
Screenshot of a text file containing JSON data with various key-value pairs, including references to payment methods and user information, overlaid with a watermark.
onion leak page1.4 MB