The Alpha Capital Group Leak Gave Hackers a Map of Trader Payments

HEROIC analysts identified a database leak tied to Alpha Capital Group, a UK-based trading firm, after the data surfaced on June 14, 2024. The full leaked archive contains 240,646 records, and HEROIC has confirmed 62,371 unique email addresses within it, tied to trading account activity including payment IDs, transaction IDs, payment types, dollar amounts, account countries, promo coupon codes, login IDs, and account creation dates.

Why This Is Dangerous

No passwords were included in this leak, but the data that was exposed paints a detailed picture of how each account uses the platform. Transaction IDs, payment amounts, and account login IDs let an attacker piece together a trader's financial habits, which is exactly the kind of detail used in convincing, personalized phishing attempts. A message referencing a real transaction amount or a real coupon code is far more likely to trick someone than a generic scam email.

What Was Exposed

• Email addresses (62,371 confirmed)
• Payment and transaction IDs
• Payment types and dollar amounts
• Account login IDs and challenge names
• Account country and creation dates
• Promo coupon codes

Why This Matters

Even without passwords, this combination of financial activity data gives attackers everything they need to run targeted scams against Alpha Capital Group traders. Knowing a real transaction ID or payment amount lets a scammer pose as customer support and ask a victim to "verify" account details, a tactic that succeeds far more often than a cold phishing attempt. Anyone in this leak should also watch for unusual login attempts, since a login ID paired with an email address narrows an attacker's guessing significantly.

How Database Breaches Happen

This incident is classified as a database breach, meaning an attacker likely gained direct access to Alpha Capital Group's backend systems rather than compromising individual users. Trading and financial platforms are high-value targets because their databases link identity, payment, and account activity in one place. A single exposed API endpoint, misconfigured server, or compromised employee credential is often enough to expose records at this scale.

Check If You Are Affected

If you have a trading account with Alpha Capital Group, check whether your email is part of this leak. HEROIC's free breach scanner searches more than 400 billion exposed records to show you instantly if your information was included and what data was attached to it.