If You Used KashinApp in Peru, Your Contact Data Was Just Leaked

HEROIC DarkHive identified a breach of KashinApp, a Peruvian mobile loan application, on 26 November 2024. The database compromise exposed 5,174 user records containing email addresses, phone numbers, first names, and last names of people who applied for short term credit through the platform.

Why This Loan App Breach Is Dangerous

Microloan users are often in immediate financial stress, which is exactly the leverage fraudsters exploit. Attackers who call or WhatsApp the 5,174 victims can pose as KashinApp collections agents demanding immediate payment, or offer fake refinancing that harvests bank credentials and ID document photos.

What Was Exposed in KashinApp

The 5,174 records include email address, phone number, first name, and last name. No passwords are in this dataset, but the combination of name, phone, and implied relationship with a loan app is uniquely dangerous because it signals the victim is actively managing debt.

Why This Matters

Peru has seen a wave of abusive microloan apps and related extortion scams, and Indecopi plus the SBS actively monitor consumer financial services. A breach of 5,174 records hands criminals a ready made list to continue that abuse under the borrowed trust of a real brand.

How Database Breaches Happen

Fintech breaches often trace to unpatched API endpoints, SQL injection in legacy services, or stolen developer credentials. Once attackers reach the user profile table, they extract it and sell the contact list to fraud crews that specialize in Latin American collections scams.

Check If You Are Affected

HEROIC monitors over 400 billion compromised records across the surface, deep, and dark web. Run a free scan to see whether your email or phone number appears in the KashinApp leak, then verify any loan related contact by calling KashinApp directly through the number on its official website before sending money or sharing documents.