California records Baanx US Corp. breach notice

California posted a sample of the breach notice filed by Baanx US Corp. and recorded Sept. 23, 2026 as the known incident date. At the same time, a series of analyses cited by outside sources says there were two unauthorized access paths, one through a third-party vendor and another through an internal administrative system, although that account is not officially confirmed in the available material.

What did California report on Baanx?

The California Attorney General’s Office released a sample of the breach notification filed by Baanx US Corp. and noted the known date of the incident. The official record places the event on Sept. 23, 2026, according to the document published by the Cybercrime Section.

The notice adds to earlier reports that examined Baanx’s filing and described the case as a disclosure of user information in the United States. Even so, the official data in California’s database confirms only the existence of the notice and the known date of the incident, not a broader technical account of the full scope of the compromise.

What do the analyses say about unauthorized access?

According to sources that reviewed the notice, Baanx appears to have identified two unauthorized access paths, one tied to an external vendor and another through an internal administrative system. That interpretation comes from Cypro and remains unconfirmed in the available official material.

The same source said Baanx reported no evidence of access to customer funds at the time of notification. DaPeer, meanwhile, said the company reset passwords and two-factor authentication for affected Crypto Life accounts, and offered 24 months of identity protection and credit monitoring through Experian IdentityWorks.

What does the available material show?

The public file available confirms the notice and the known date of the incident, but does not provide further official confirmation about the exact access method or the final impact on customers. Details about exploitation, internal response, and mitigation measures appear in third-party analyses, not in the official notification cited in the material.

In the same set of sources, KELA also reported an active phishing infrastructure with 248 fraudulent domains linked to 189 U.S. banks and financial services. The operation used cloned sites and fake suspended-account pages to make detection harder and keep the fraud sites online.