Olympic Channel films ‘Personal Best’ and ‘I’m Carl Lewis’ were honoured with podiums d’or (golden podiums) at the prestigious SPORTEL Awards on Monday (October 20).
‘Personal Best’ received the golden podium for Best Thematic…
Olympic Channel films ‘Personal Best’ and ‘I’m Carl Lewis’ were honoured with podiums d’or (golden podiums) at the prestigious SPORTEL Awards on Monday (October 20).
‘Personal Best’ received the golden podium for Best Thematic…
When the pandemic hit, the author and cultural consultant András Szántó didn’t let the crisis go to waste. He picked up the phone, calling museum directors for a series of interviews that formed his 2021 book The Future of the Museum. That…
We recently published an Insights piece “The Golden Scale: Bling Libra and the Evolving Extortion Economy,” which primarily focused on the Salesforce data theft extortion activity. This was associated with the cybercriminal syndicate known as Scattered LAPSUS$ Hunters. Since early October 2025, we have observed several notable developments within a Telegram channel (SLSH 6.0 part 3) used by the threat actors. This activity may provide a glimpse into how the group plans to operate in the foreseeable future. We’re providing these insights so that organizations can better prepare for and defend against this evolving threat activity.
As noted in our previous Insights piece, Scattered LAPSUS$ Hunters listed the deadline for impacted organizations to make a ransom payment as 11:59 PM ET on Oct. 10, 2025. Since that time, news reports have indicated that the threat actors have leaked stolen data allegedly belonging to six companies. These companies operate across the aviation, energy and retail sectors. The leaked data allegedly includes various types of personally identifiable information (PII) such as names, dates of birth, email addresses, phone numbers and frequent flyer numbers.
Unit 42 recently tried to access the data leak site (DLS) associated with the threat actors, and noticed the website had what appeared to be a defacement message posted (see Figure 1). As a result, we were unable to determine if any victim data was still listed.
On Oct. 11, 2025, a day after the posted deadline and the release of data for the six organizations referenced above, the threat actors stated that “nothing else will be leaked.” The meaning of “the things we have cannot be leaked for obvious reasons” is unclear (see Figure 2). These “obvious reasons” could mean increased attention and action from law enforcement due to who owns the data or its type.
As shown below in Figure 3, the threat actors appear to potentially be stepping away from any activities until the beginning of next year. A post after this one states “I promise you, you WILL feel our wrath.”
On Oct. 10, 2025, shortly prior to their self-imposed deadline, the threat actors formally alluded to the launch of their extortion-as-a-service (EaaS) program as shown in Figure 4. They claim this EaaS program will be similar to a typical ransomware-as-a-service (RaaS) program with a clear difference: no file encryption. As noted in my previous Insights piece, one likely factor for this shift is to potentially fly under the radar of law enforcement attention. This could be motivated by their focus on disrupting ransomware operations in recent years.
On Oct. 5, 2025, the threat actors posted an advertisement seeking insider access at organizations across a variety of industries, as seen in Figure 5.
As also noted by ReliaQuest on their X account, the threat actors state their primary interest is in acquiring access to call centers, gaming companies, hosting providers, software-as-a-service (SaaS) and telecom organizations. These organizations would be based in countries such as the U.S., UK, Australia, Canada and France.
Threat actors affiliated with “The Com” have previously advertised interest in partnering with insiders at targets of interest to them. This was reported in our May 2025 update on Muddled Libra (aka Scattered Spider).
On Oct. 4, 2025, the threat actors claimed to be developing a new form of ransomware named “SHINYSP1D3R” as noted in Figures 6 and 7. These posts appear to be related to observations previously noted by Falconfeeds in August 2025. It is currently unclear if the aforementioned ransomware is still under development or simply a false claim.
Given that the clearnet version of Scattered LAPSUS$ Hunters’ newly launched DLS is unavailable at this time, it is unclear if any of the victims listed on the site made a ransom payment to the threat actors.
Additionally, it remains relatively uncertain if the EaaS program advertised by the threat actors will be as lucrative of a business model as they likely hoped it would be. Given that the advertisement specifically cites the removal of any file encryption in comparison to a traditional RaaS program, organizations may be less willing to make a ransom payment considering the potential lack of operational disruption.
Finally, it is not evident why the threat actors would potentially be interested in operating both an EaaS and a RaaS program, other than attempting to diversify their revenue streams. This is certainly something Unit 42 will continue to monitor going forward.
As noted in our previous Insights piece, the theft and leakage of PII, including loyalty program details (e.g., frequent flyer numbers) from some victim organizations (specifically those in hospitality) could enable cybercriminals to conduct identity theft and other types of fraud, including fueling the growth of fraudulent travel agencies advertised across underground cybercrime forums and Telegram channels.
Given the rise of RaaS programs in recent years, many organizations have developed incident response playbooks specifically to prepare for a ransomware event in terms of operational disruption. I believe it is now time for organizations to create similar playbooks for the growing threat of EaaS programs, specifically to prepare for the reputational risks associated with such events. This should include having third-party experts on standby via retainer to assist with potential negotiations, verification of stolen data and other related actions.
If your organization has been threatened with data theft extortion by Scattered Lapsus$ Hunters or other cybercriminals, the Unit 42 Incident Response team is here and ready to support with either a suspected compromise or to reduce the risk via a proactive threat assessment.
Technology – especially AI – is disrupting the world of finance (see overviews in Duffie et al. 2022, Foucault et al. 2025, and Vives 2019). Lending is no exception: machine learning and large datasets are successfully used for credit assessment. Fintech has enabled efficiency gains, such as improved loan screening, monitoring, and processing, and has fostered financial inclusion among underserved populations and in less developed countries.
At the same time, it raises concerns about financial stability, privacy, and discrimination. Digital technologies enable improved customer segmentation, which not only facilitates personalised services but also allows for finer price discrimination. The empirical evidence on fintech’s impact is mixed regarding loan pricing, substitutability or complementarity of fintech and bank credit, loan default, and data sharing.
Empirical studies differ on whether default or delinquency rates are higher for fintech-originated loans than for bank-originated loans. While some report higher default rates (Di Maggio and Yao 2021), others report lower (Fuster et al. 2019), and still others find no significant difference (Buchak et al. 2018). Similarly, open banking initiatives increase the likelihood that SMEs form new lending relationships with non-bank lenders and reduce their interest payments. Still, they do not necessarily improve financial inclusion (Babina et al. 2024). However, in Germany (Nam 2023) and India (Alok et al. 2024), open banking has improved credit access on both extensive and intensive margins without increasing risk. In the US, California’s Consumer Privacy Act strengthened fintechs’ screening capabilities relative to banks and enabled more personalised mortgage pricing, ultimately reducing loan rates and improving financial inclusion (Doerr et al. 2023).
In Vives and Ye (2025a, 2025b), my co-author and I present an analytical framework that incorporates key differences between fintech firms and incumbent banks, explains the mixed empirical findings in the literature, and delivers a welfare analysis. The framework introduces a taxonomy of how fintech affects frictions in the lending market. We find that fintech’s impact on competition and welfare hinges on its effect on the differentiation between financial intermediaries and the efficiency gap between them. Primary factors influencing market performance include the level of bank concentration, the intensity of competition among fintechs, the potential for price discrimination, the size of the unbanked population, and the convenience offered by fintechs.
We consider a spatial oligopolistic competition model in which lenders (banks and fintechs) compete to provide loans to entrepreneurs. The framework captures key differences between fintechs and banks. For example, banks have more financial data and soft information (with relationship lending) than fintechs, but the latter have better information-processing technology and conversion of soft into hard information (with the digital footprint) and lower distance friction with borrowers. This distance can be physical or in terms of expertise; greater distance between a lender and borrower increases the cost of monitoring (or screening).
Furthermore, banks have lower funding costs, and fintechs have higher convenience benefits. Fintechs also have greater price flexibility for technological and regulatory reasons, which gives them a competitive advantage. In the extreme, banks are differentiated by expertise (location), but fintechs are not; fintechs can price discriminate, whereas banks cannot. In our model, endogenous entrepreneur participation occurs at each location, and entrepreneurial projects require monitoring (screening) to enhance project returns (Vives and Ye 2025b) or to mitigate a moral hazard problem faced by entrepreneurs (Vives and Ye 2025a).
A key insight from Vives and Ye (2025a) is that we should distinguish between general advances in fintech that reduce the distance between lenders and borrowers and those that do not. General improvements in information collection and processing, such as enhanced data storage, computing power, or desktop software, do not necessarily reduce distance friction. Technologies that lower the effective distance between lenders and borrowers include improved internet connectivity, video conferencing, remote learning tools, AI, and advanced search engines, which enable lenders to expand their domain expertise and serve distant borrowers more effectively. Big data, together with machine learning, can improve both types of capabilities.
If fintech does reduce the distance friction, lenders’ differentiation will decrease and competition intensity will increase, decreasing their profits and monitoring incentives. The effect is more pronounced when the entrepreneurs’ moral hazard problem is more severe. The impact on entrepreneurs’ investment and total welfare is hump-shaped. Those effects are not present when fintech progress does not affect the distance between lenders and borrowers.
In Vives and Ye (2025b), we assume that banks are differentiated by expertise (located in a circle) but fintechs are not (located in the virtual middle). We find that (1) fintech entry can be blockaded, remain as a potential threat, or materialise depending on fintechs’ monitoring efficiency, (2) fintech lending can substitute or complement bank lending depending on whether pre-entry banks competed or not, and (3) fintech entry and loan volume is higher when bank concentration is higher.
Furthermore, if banks cannot price discriminate, a fintech with no advantage in terms of monitoring efficiency or funding costs can enter the lending market. If banks and fintechs have similar funding costs, for entrepreneurs with similar characteristics, banks’ loan rates and monitoring are higher than those of fintechs (and fintech borrowers are more likely to default). The latter result will change if fintechs have significantly higher funding costs than banks. If fintechs have a significant advantage in convenience, they will likely charge higher prices, while banks will conduct more thorough monitoring. Therefore, differences in funding costs, convenience benefits, and abilities to price discriminate may explain the variety of empirical results on loan defaults by banks and fintechs.
Fintech entry may decrease entrepreneurs’ investment if competition within fintechs is not sufficiently intense. An intermediate level of competition intensity among fintechs is needed to ensure a welfare increase following fintech entry, to balance the incentives of borrowers and lenders.
However, if banks can also discriminate, fintechs need an advantage in monitoring (or funding costs, although this is less probable) to penetrate the market. Finally, the threat or actual entry of fintechs can induce bank exit or restructuring, potentially reducing the intensity of lending competition and investment, but generating a welfare-improving option value effect.
We can derive some policy implications from the analysis. We know that price discrimination is a competitive weapon, but it will not necessarily be welfare optimal unless it extends the market. This is so also in our modelling. Socially optimal loan rates strike a balance between the incentives of entrepreneurs and intermediaries to exert effort, thereby mitigating moral hazard, encouraging entrepreneur participation in the market, and enhancing lenders’ monitoring or screening effort.
However, this balance typically cannot be obtained from lender competition with location-based discrimination. For example, with endogenous entrepreneur participation at any location, a bank should charge (from a welfare perspective) higher rates for distant locations (since monitoring is more costly and distant locations generate less surplus). In contrast, price-discriminating banks will do the opposite in equilibrium to meet the competition. However, allowing banks to discriminate when fintechs price discriminate improves welfare when there is little inter-fintech competition.
Regarding data sharing, we find that a policy (e.g. open banking) that benefits fintechs must be complemented by an appropriate degree of inter-fintech competition. Otherwise, the policy may backfire, and a leading fintech may gain a monopoly position in a market segment. Differences in the degree of competition may explain the differences in the empirical results in the impact of open banking.
In summary, levelling the playing field (in terms of lenders’ ability to price discriminate and access to information) is a good policy aimed at achieving a degree of competition that induces a division of rents, thereby balancing the incentives of different market participants to maximise welfare. This degree of competition must be sufficient to prevent monopoly positions in market segments, while also ensuring that both lenders and borrowers have enough stake in the game.
Alok, S, P Ghosh, N Kulkarni, and M Puri (2024), “Open banking and digital payments: Implications for credit access”, working paper.
Babina, T, S A Bahaj, G Buchak, F De Marco, A K Foulis, W Gornall, F Mazzola, and T Yu (2024), “Customer data access and fintech entry: Early evidence from open banking”, working paper.
Buchak, G, G Matvos, T Piskorski, and A Seru (2018), “Fintech, regulatory arbitrage, and the rise of shadow banks”, Journal of Financial Economics 130: 453–83.
Di Maggio, M, and V Yao (2021), “FinTech borrowers: Lax screening or cream skimming?”, The Review of Financial Studies 34: 4565–618.
Doerr, S, L Gambacorta, L Guiso, and M Sanchez del Villar (2023), “Privacy regulation and fintech lending”, working paper.
Duffie, D, T Foucault, L Veldkamp, and X Vives (2022), Technology and finance, The Future of Banking 4, CEPR Press.
Foucault, T, L Gambacorta, W Jiang and X Vives (2025), Artificial intelligence in finance, The Future of Banking 7, CEPR Press.
Fuster, A, M Plosser, P Schnabl, and J Vickery (2019), “The role of technology in mortgage lending”, The Review of Financial Studies 32: 1854–99.
Nam, R J (2023), “Open Banking and Customer Data Sharing: Implications for Fintech Borrowers”, SAFE Working Paper No. 364.
Vives, X (2019), “Digital disruption in banking”, Annual Review of Financial Economics 11: 243–72.
Vives, X, and Z Ye (2025a), “Information technology and lender competition”, Journal of Financial Economics 163: 103957.
Vives, X, and Z Ye (2025b), “Fintech entry, lending market competition, and welfare”, Journal of Financial Economics 168: 104040.
A new review uncovers how chronic alcohol consumption accelerates Alzheimer’s pathology through oxidative stress and neuroinflammatory cascades, while spotlighting promising molecular and metabolic interventions to protect the…
Huawei’s Mate 80 series could be announced as soon as November, according to a new rumor from Digital Chat Station on Weibo. That may still change and the launch could slip into December, but for now November seems to be the plan.
The Mate…
Slashed contributions from wealthy countries to an anti-malaria fund could allow a resurgence of the disease, costing millions of lives and billions of pounds by the end of the decade, according to a new analysis.
The fight against malaria faces…
Cuts to the world’s biggest funder of malaria prevention, including by the UK government,…