Digital banking app and tech unicorn Dave confirms a security breach after a hacker published personal information on 7.5M+ of its users on a public forum
Dave user data is now available for download on a public hacking forum. — Digital banking app and tech unicorn Dave.com confirmed today …
Context & Ripple Effects
Dave's confirmation lands one day after analytics vendor Waydev disclosed that hackers stole its GitHub and GitLab OAuth tokens and were likely using them to pivot into customers like Dave — a reminder that this breach may have entered through a supplier, not the bank itself. Days later, the same hacker posted data on 18 companies including Dave and Wattpad to a forum for free, signaling the loot was being distributed rather than sold.
The episode fits a pattern in neobanking and consumer platforms: Revolut disclosed a cyberattack exposing details on 50,150 customers two years later, while forum-dumped datasets from MeetMindful and 23andMe show public forums have become the standard distribution channel for stolen user records.
First-order effects
- Personal information on more than 7.5 million Dave users is now downloadable by anyone on a public hacking forum, forcing the digital banking app into breach disclosure and user-notification mode.
- Waydev's admitted loss of GitHub and GitLab OAuth tokens puts its customer base — Dave among them — on notice that their vendors' source-control credentials are an attack surface.
Second-order effects
- Fintech peers like Revolut face the same playbook and will be pushed toward tighter vendor access controls and faster disclosure filings, since regulators and users now compare response times across neobanks.
- Free distribution of the dataset undercuts traditional ransom economics: when stolen data is dumped for free, victims gain no negotiating leverage, shifting the cost entirely onto breach remediation and churn.
Third-order effects
- If supply-chain pivots via developer-tool OAuth tokens become routine, procurement in financial services will start treating vendors' code-repository security as a first-class due-diligence requirement rather than an IT footnote.
- Public forums consolidating multi-company dumps — the same channels behind the 23andMe investigation — point toward a structural shift where breach impact is measured by how widely data circulates, not just how many records left the victim's systems.
The trend: Neobanks and consumer apps are converging on a world where breaches surface as free forum dumps sourced through vendor credentials, making third-party access control and rapid disclosure the competitive baseline.