The LoyLap Dump: 44,982 Stolen Payment and Loyalty Records Hit the Dark Web

In October 2024, LoyLap, an Irish fintech company providing closed-loop payment systems including gift cards, loyalty programs, and cashless ordering solutions, suffered a database breach that exposed tens of thousands of customer records. The leaked data went far beyond basic contact details, capturing transactional histories and gift card information, putting customers at direct financial risk. If you used a LoyLap-powered loyalty or payment program, your personal and financial data may have been compromised.

Why This Is Dangerous

Payment and loyalty platform breaches carry a uniquely elevated risk profile. Unlike a simple contact list leak, transactional data tells attackers how much victims spend, where they shop, and what loyalty balances they hold. Gift card data is directly monetizable -- criminals can drain card balances immediately. The combination of personal identifiers with behavioral and financial data makes this breach particularly valuable to fraudsters and identity thieves.

What Was Exposed

• Email addresses -- primary vector for phishing and account access attempts
• First and last names -- enable personalized social engineering
• Usernames -- can be cross-referenced across other platforms
• Dates of birth -- used to bypass identity verification checks
• Gender -- combined with other fields for targeted profiling
• Transaction histories -- reveals spending habits and merchant relationships
• Gift card data and balances -- directly exploitable for financial fraud

Records exposed: 44,982 | Breach type: Database | Date leaked: October 2024 | Country: Ireland

Why This Matters

• Gift card fraud: Exposed card data can be immediately drained by attackers before victims notice.
• Credential stuffing: Email and username combinations are tested against banking, e-commerce, and social accounts at scale.
• Account takeover: Date of birth combined with email is enough to pass many account recovery flows.
• Identity theft: The full profile -- name, email, username, DOB, gender, and transaction history -- is sufficient to impersonate a victim in financial and government contexts.
• Targeted phishing: Attackers can craft emails referencing specific merchants or loyalty programs the victim is known to use.

How a Database Breach Works

A database breach occurs when an unauthorized party accesses the back-end data store of a platform. For payment and fintech companies, attackers commonly exploit insecure API endpoints, weak admin credentials, SQL injection flaws, or vulnerabilities in third-party integrations. Because payment platforms must store transaction records for business operations, a single successful intrusion can yield years of customer activity. The stolen data is then packaged and sold on dark web marketplaces or distributed via private Telegram channels to fraudsters who specialize in gift card and payment fraud.

Check If You Are Affected

Heroic searches over 400 billion breached records, giving you one of the most complete views of your personal data exposure available anywhere. Run a free search to find out whether your email address appears in the LoyLap breach or any other known data leak.

Search your email now at Heroic.com -- free, instant, and private.