Exfiltración confirmada de datos de Merchant Web de Cashea

What this source supports

• malconguerra2 visibly published the Cashea claim
• the post alleges a 46.5 GB JSON archive and 79,006,942 transaction-history records
• the post visibly includes apparent store, merchant and transaction samples
• a reply calls the material a repost and the author disputes that characterization

Evidence limits

Actor-controlled forum. Visible samples lack an independently verified chain of custody; the audit did not download the gated dataset or test exposed personal/banking values.

Relevance to this case

Primary provenance for the actor claim and its visible scope, not independent proof of Cashea origin, completeness or counts.

What this source supports

• Cashea confirmed a data leak detected on 21 February
• the reproduced company statement says user and partner accounts/passwords remained protected and the app operational

Evidence limits

Republished secondary report; no independent technical analysis and no support for actor volumes.

Relevance to this case

Contemporaneous confirmation and statement context.

What this source supports

• Cashea reported detecting the leak on 21 February
• Cashea said credentials/passwords were not compromised and the event was contained

Evidence limits

Secondary report dependent on Cashea; no independent technical validation or dataset count.

Relevance to this case

Reliable contemporaneous occurrence and response coverage.

What this source supports

• 2001 reports the VECERT/malconguerra2 claim of 46.5 GB and approximately 79 million transaction records
• the article reports Cashea's confirmation and protected accounts/passwords

Evidence limits

Secondary report; all volumes are derivative and not independently validated.

Relevance to this case

Documents public circulation of the claim and company response.

What this source supports

• Punto de Corte repeats VECERT's alleged figures
• the article reports Cashea's statement that access methods and passwords were protected

Evidence limits

Derivative coverage closely duplicated by Cactus24; no independent technical artifact.

Relevance to this case

Claim/response provenance only.

What this source supports

• DarknetSearch repeats an underground-forum claim of 46.5 GB and 79,006,942 transaction logs
• the article describes fields attributed to visible samples

Evidence limits

Commercial aggregation misidentifies DarkForums as BreachForums and contains stale/no-confirmation language; no independent validation.

Relevance to this case

Context for later claim circulation, not corroboration.

What this source supports

• Efecto Cocuyo reports VE Sin Filtro's review of a sample containing names, IDs, phones and transaction/merchant information
• it reports Cashea's confirmation and service continuity
• actor volumes remain attributed

Evidence limits

Independent publisher but dependent on VE Sin Filtro, VECERT and Cashea; no public chain of custody for the sample.

Relevance to this case

Useful attributed sample and risk reporting.

What this source supports

• La Patilla reports Cashea's confirmation in the early hours of 22 February
• the company statement says accounts/passwords remained protected and the app operational

Evidence limits

Secondary report; referential image is not a technical artifact and no dataset validation is supplied.

Relevance to this case

Contemporaneous confirmation/continuity coverage.

What this source supports

• Grupo Apok reproduces VECERT and VE Sin Filtro claims
• the article distinguishes data exposure from ransomware or demonstrated outage

Evidence limits

Derivative advisory article; embedded/mirrored social content is not independent X proof.

Relevance to this case

Public-risk context only.

What this source supports

• Cactus24 repeats the same VECERT figures and Cashea response carried by Punto de Corte

Evidence limits

Near-duplicate derivative coverage; no independent corroboration.

Relevance to this case

Preserves circulation provenance only.

What this source supports

• Caleidoscopio Humano republishes Efecto Cocuyo's Cashea/VE Sin Filtro report

Evidence limits

Explicit republication, not independent corroboration.

Relevance to this case

Mirror/archive provenance only.

What this source supports

• Caracas Chronicles repeats VECERT-attributed Cashea figures in a cybersecurity opinion article

Evidence limits

Opinion/business commentary; no technical investigation and figures are asserted too strongly.

Relevance to this case

Public-discourse context only.

What this source supports

• Con-Café reproduces the Cashea communication and discusses the unverified 79-million figure

Evidence limits

Informal commentary without independent technical validation.

Relevance to this case

Statement/public-reaction context only.

What this source supports

• El Pitazo reports Cashea's confirmation
• VE Sin Filtro is quoted describing names, IDs, phones and transaction data in the sample while noting possible additional extraction
• the sample reportedly contained no passwords or user email addresses

Evidence limits

Secondary source dependent on VE Sin Filtro/VECERT and Cashea; no public sample chain of custody.

Relevance to this case

Attributed sample and company-response reporting.

What this source supports

• malconguerra2 visibly labels the entry RE-POST UPDATE of the 21 February Cashea material
• the post repeats 46.5 GB and 79,006,942 transaction-history records
• the post links a sample and warns about competing sample claims

Evidence limits

Actor-controlled repost; images and statements are not independent authentication of the dataset.

Relevance to this case

Shows later republication of the same alleged dataset and must not create a second incident.

What this source supports

• Cashea confirms unauthorized access and exfiltration from Merchant Web between 30 January and 21 February
• Cashea identifies externally compromised valid partner-employee credentials, automated requests, weak API authorization, absent rate limiting and excessive token TTL
• Cashea lists names, IDs, phones, orders and merchant operational data
• Cashea excludes passwords, infrastructure credentials, private keys, secrets, cloud infrastructure, financial systems and payment-processing components
• Cashea records containment, Mandiant review and a CICPC complaint

Evidence limits

Primary victim account; no public Mandiant report, complete affected-person count or validation of the actor volumes.

Relevance to this case

Strongest evidence for occurrence, window, vector, confirmed fields, containment and exclusions.

What this source supports

• El post existía el 9 de mayo y resumió el reclamo de 46,5 GB y datos supuestamente fechados en febrero.

Evidence limits

FxTwitter es un espejo dependiente para texto y metadatos, no una fuente independiente ni una inspección del hilo/muestra.; No valida el acceso, contenido, 79 millones ni la fecha de las filas.; La coincidencia con el repost de mayo y el anuncio de febrero la sitúa en la misma familia de publicaciones; por sí sola no resuelve el linaje completo.

Relevance to this case

Fuente relacionada al evento existente. El post existía el 9 de mayo y resumió el reclamo de 46,5 GB y datos supuestamente fechados en febrero.

What this source supports

• Identifica autor, texto y fecha del mismo anuncio.

Evidence limits

Misma publicación; no autentica corpus ni actividad y no es corroboración independiente.

Relevance to this case

Fuente relacionada al evento existente. Identifica autor, texto y fecha del mismo anuncio.

What this source supports

• El post existía el 9 de mayo y difundió esas afirmaciones, que difieren sustancialmente del reclamo de 46,5 GB.

Evidence limits

FxTwitter es un espejo dependiente, no corroboración.; El texto no enlaza ni identifica el hilo o vendedor original; no se pudo cotejar la fuente primaria, la relación con el repost del 8 de mayo, ni el origen de los campos y el volumen.; La cifra, alcance y autenticidad permanecen sin validar.

Relevance to this case

Fuente relacionada al evento existente. El post existía el 9 de mayo y difundió esas afirmaciones, que difieren sustancialmente del reclamo de 46,5 GB.

What this source supports

• Identifica autor, texto y fecha del mismo anuncio.

Evidence limits

Misma publicación; no autentica corpus ni actividad y no es corroboración independiente.

Relevance to this case

Fuente relacionada al evento existente. Identifica autor, texto y fecha del mismo anuncio.

What this source supports

• VECERT mostró CASE #5916: «Cashea Leak, +600GB and 79 million transactions», alias dev0x7C00, monitor 2026-05-08.
• VECERT mostró CASE #2904: «CASHEA Venezuelan Bank Accounts, Phone Numbers, RIFs», alias GordonFreeman, monitor 2026-01-30.
• VECERT mostró CASE #2284: «Cashea App JSON Leaks», alias HvcKMvSoneria33, monitor 2025-12-25.

Evidence limits

Relación de contexto; no se prueba igualdad de corpus o publicación salvo que lo precise la traza. La metadata no valida las cifras ni la actividad.

Relevance to this case

Conserva la referencia y sus límites para revisar el reclamo; no acredita acceso, origen de datos o impacto.

What this source supports

• VECERT enlazó esta URL como origen de la ficha; se preserva la procedencia del enlace, sin afirmar identidad de corpus.

Evidence limits

No se recuperó el cuerpo original. El slug, su cifra y su fecha no validan contenido o actividad; no constituye corroboración independiente.

Relevance to this case

Conserva la referencia y sus límites para revisar el reclamo; no acredita acceso, origen de datos o impacto.

What this source supports

• VECERT enlazó esta URL como origen de la ficha; se preserva la procedencia del enlace, sin afirmar identidad de corpus.

Evidence limits

No se recuperó el cuerpo original. El slug, su cifra y su fecha no validan contenido o actividad; no constituye corroboración independiente.

Relevance to this case

Conserva la referencia y sus límites para revisar el reclamo; no acredita acceso, origen de datos o impacto.