Finzly Corp Data Breach

Finzly Corp, a financial technology provider operating the domain finzly[.]com, was claimed as a victim by the N0n ransomware group on October 19, 2026. The US company supplies real-time payment processing and SWIFT-connected banking infrastructure to banks and credit unions across the United States, placing it in the financial-technology supply chain rather than in the category of an ordinary corporate victim. SOCRadar identified the claim on the ransomware group’s leak site through its dark web monitoring. Finzly’s position upstream of client bank connections is central to the incident’s significance: if client bank connections fall within the scope of a compromise, systemic downstream risk follows, and that exposure profile makes a payment infrastructure provider a conspicuously attractive target for extortion-driven ransomware activity. The listing fits N0n’s ongoing US campaign, which has spanned healthcare, hospitality, and financial services victims. Finzly aligns with the campaign’s US focus and its financial services targeting, but represents an escalation into payment infrastructure software — a category where a single compromised vendor connection can expose multiple downstream banks at once. That escalation distinguishes Finzly from the group’s typical victim profile in terms of potential systemic reach, and it signals that the campaign is extending from sector-level targeting toward the financial supply chain itself.

SOCRadar’s stealer-log telemetry query for the finzly[.]com domain returned 25 records, all classified as internal employee credentials rather than customer or third-party data. The high-value endpoints represented include id.atlassian.com, tied to Atlassian identity for project management and internal tooling; signon.oracle.com and profile.oracle.com, covering Oracle ERP and account management; login.swift.com, exposing SWIFT payment infrastructure credentials and rated critical; account.mongodb.com for database management; identity.getpostman.com, an API development and testing platform; and the tenant SaaS services finzly.datalligence.ai and finzly.greythr.com. Every record follows a single corporate-domain username pattern, and the freshness window runs from June 2026 through October 13, 2026, meaning the most recent records surfaced only days before the October 19 listing. The endpoint mix is the core of the assessment: SWIFT credentials exposed alongside Oracle ERP and Atlassian identity form what SOCRadar characterizes as a textbook pre-ransomware credential chain. Four months of stealer activity concentrated on one employee’s footprint — covering payment infrastructure, ERP, and identity management — is unlikely to be coincidental. Credentials exposed at this concentration could plausibly support account access and staging for a ransomware operation, although the telemetry confirms credential theft, not the specific intrusion method used against Finzly. The recommended response is urgent and specific: rotate all affected credentials immediately and conduct a forensic review of SWIFT and Oracle access logs covering June 2026 onward, rather than waiting on the N0n claim timeline to act. Continued monitoring of stealer logs and ransomware leak sites is warranted to detect any further records or developments tied to Finzly’s domain.