GCash User Data Allegedly for Sale on Dark Web Amid Double Unicorn's IPO Hopes

Philippines' dominant fintech platform, GCash, stands at the precipice of a monumental initial public offering (IPO). But as the celebrated 'double unicorn' prepares for its public debut, a dark shadow has emerged from the depths of the internet, threatening its celebrated rise.

A massive cache of alleged user data has surfaced for sale on a dark web forum, casting a pall over the market's most anticipated listing.

A user operating under the name 'Oversleep8351' posted the listing. The seller claims to possess sensitive records spanning from 2019 to October 2025.

The data allegedly includes critical eKYC (Know Your Customer) information, linked bank accounts, and GCash numbers. The post claims the dump affects both merchant and basic users, exposing names, addresses, employment history, and even valid Philippine IDs.

The entire database, purportedly containing 7–8 million users, is offered in bundles priced up to £20,800 ($25,000). Payment is demanded only in the privacy-focused cryptocurrency Monero (XMR).

According to the post, the data is 'unorganised', meaning buyers must sort it manually. The seller also specified they would only transact with 'existing buyers' from previous dark web deals.

Why This Alleged Leak Couldn't Come at a Worse Time

This alleged security breach arrives at a critical moment. The much-awaited GCash IPO is widely seen by analysts as a pivotal event for the Philippine startup community.

'We need to be able to encourage founders and investors that there is an exit potential, that their investment of their time or capital in that startup can lead to an outcome that's great for everyone', Paulo Campos III, a founding managing general partner at Kaya Founders, told BusinessWorld.

GCash Denies Claims and Confirms New £4.17 Billion Valuation

In response to the allegations, GCash was unequivocal. Bruce Rodriguez, Senior Manager for Business Communication, stated the company was 'debunking this claim' and pointed to official statements on its social media pages.

While addressing the incident, the company also provided key updates on its financial status, correcting previous reports. Its parent company, Globe Fintech Innovations, Inc. (Mynt), is no longer just a 'double unicorn'.

Mynt is now valued at approximately £4.17 billion ($5 billion) following fresh investments from Japan's MUFG and the Philippines' Ayala Corp. in August 2024.

Furthermore, GCash clarified that despite rampant speculation—including previous analyst targets of a £6.67 billion ($8 billion) valuation—it has made 'no official announcements about its planned IPO, which includes potential offer size or any specific timings'.

More Than an IPO: A 'Game-Changer' for the Nation's Tech Hopes

The sensitivity around the IPO is high because its success is seen as nationally significant. Rene Cuartero, founder and CEO at venture capital firm AHG Lab, called the GCash IPO a potential 'game-changer' for the nation's expanding startup ecosystem.

'The IPO will show proof of a pathway for a lot of our startups in the Philippines towards listing in the market', he said. 'It will also be an excellent test case on what regulations might need to be adjusted in order to accommodate large and smaller tech companies that want to [list]'.

This readiness aligns with the typical 10-year journey for a startup. Since its 2004 launch, GCash has grown to over 94 million registered users and operates in 16 markets, including the US, UK, and Japan.

Oscar Enrico A. Reyes, Jr., president and CEO at G-Xchange, Inc., which operates GCash, stressed the IPO's importance. 'It's very important that it becomes a successful IPO... And if that happens, the whole investment community starts seeing the Philippines as a potential tech hub'.

'This is something that's homegrown, and if we can be one of the biggest and most successful kind of startup that is publicly [listed,] then hopefully it encourages more investors to look for other opportunities here in the Philippines', he added.