STOKR (digital securities platform) Listed by N0n Ransomware Group

Your KYC records and tax ID have been listed on a ransomware group's leak site. The group N0n claims it holds your full name, email, country of residence, nationality, wallet address, and tax identification details from your STOKR investor account, along with an identity-to-crypto-wallet mapping. STOKR has not publicly confirmed the claim as of writing.

This means the permanent parts of your identity that you used to satisfy regulatory checks on a regulated European digital securities platform are now being used as leverage. Tax IDs, nationalities, and wallet addresses do not expire. If the claim is accurate, the data creates a long-term link between your real-world identity and specific crypto holdings that attackers or third parties can exploit for targeted fraud, phishing, or regulatory pressure.

What a Leak-Site Listing Actually Establishes

A listing on a ransomware extortion site is an accusation, not evidence. These groups frequently publish partial data, old data, or entirely fabricated samples to pressure companies into paying. Sometimes the files were taken but the volume is inflated. Sometimes the listing recycles data from an earlier unrelated compromise. N0n has not released any proof beyond the claim itself.

Real confirmation would require STOKR to issue a formal regulatory notification, contact affected investors directly, or for an independent authority to validate the incident. Until that happens, the only documented fact is that one extortion group has named STOKR on its public page dated September 18, 2026. The record gives no number of affected individuals and does not specify when any incident may have occurred.

Why KYC-to-Wallet Mappings Matter in Fintech

Ransomware crews have repeatedly targeted platforms that must collect detailed investor identity information under EU AML rules. The combination of verified names, tax IDs, and on-chain wallet addresses is particularly valuable because it survives password changes and cannot be reissued like a credit card. It allows attackers to build persistent profiles for spear-phishing, tax authority impersonation, or selling the mapping to parties interested in linking pseudonymous crypto activity to real people.

Because STOKR operates in Luxembourg and serves investors across France, Germany, Switzerland, Belgium, the Netherlands, the UK and other jurisdictions, the group also claims it will forward the investor data to the relevant national tax authorities if no settlement is reached. That threat adds regulatory and tax-exposure pressure on top of ordinary identity risk.

The Password Situation Remains Unknown

The listing does not disclose whether any password data was taken or how it was stored. Without that information you cannot assume the credentials are safely hashed. Treat your STOKR password as potentially compromised. Change it immediately on STOKR and on every other site where you reused it. Enable a unique, strong password for this account going forward.

What You Should Do Now

• Change your STOKR password today and do not reuse it anywhere else. Use a password manager to generate and store a unique one.
• Enable two-factor authentication on your STOKR account and every linked email, exchange, and wallet service if you have not already done so.
• Monitor your tax-related communications. If the data is genuine, tax authorities in your country of tax residence may receive a copy; watch for unexpected correspondence from them.
• Watch for targeted phishing that references your STOKR activity, specific wallet addresses, or nationality. Attackers who hold this mapping can make messages appear highly legitimate.
• Contact STOKR directly to ask whether they have confirmed any breach and whether they will be notifying investors. Their response is the only way to move from claim to confirmed status.

Absence of a direct notification from STOKR does not prove your records were untouched; letters can be delayed or misdelivered. If you have changed address since opening your STOKR account, reach out to them to confirm your status.

GalaxyWarden provides continuous monitoring across 13.1B+ breach records and 100+ platforms, identity-chain mapping, and remediation handled by specialists.