Redem Data Breach
The 2022 Redem data breach occurred in August 2022 when the production database of Redem (getredem.io), a Nigerian and West African fintech platform specializing in gift card trading, cryptocurrency exchange, and digital bill payments, was breached and leaked on cybercrime forums.
Exposed Data Types
11- Email addresses
- Usernames
- Passwords
- Names
- Phone numbers
- Government issued IDs
- Bank account numbers
- Dates of birth
- Financial transactions
- Auth tokens
- IP addresses
About This Breach
What information was affected in the Redem incident?
The leaked SQL dump (getredem.io.sql) encompasses full user profiles, KYC records, and transactional histories. Compromised records for 26,085 unique users include:
- Personal & Identity Details: Full legal names (firstname, lastname) and usernames.
- Government & Banking Identifiers: Bank Verification Numbers (BVN), national identity document records, and verification selfies.
- Contact Credentials: Canonical email addresses and mobile telephone numbers.
- Authentication Secrets: bcrypt-hashed passwords and authentication session tokens.
- Financial & Transactional Records: Digital wallet balances, bank account details, gift card trade orders, and utility payment logs.
- Network & Device Data: Client IP addresses and hardware session fingerprints.
How many accounts were affected?
Rigorous RFC canonical parsing and deduplication confirmed 26,085 unique valid email addresses.
Technical analysis and security risks
The exposure of Bank Verification Numbers (BVN) combined with photo IDs and full financial transaction records creates severe exposure to synthetic identity theft, fraudulent banking transfers, and targeted financial engineering.
Recommended actions for affected users
Individuals who used the Redem fintech application should:
- Alert their banking institutions to place protective fraud monitoring on their accounts.
- Change credentials on all online services sharing similar passwords.
- Remain vigilant against fraudulent impersonation schemes citing their BVN or financial activity.
Verification and editorial method
LeakData compares the incident name, date, affected-record count, and exposed data types with accessible sources. Unverified fields are not presented as facts, and records are updated when new evidence becomes available.
Report missing or incorrect information
