Ceres has publicly disclosed two distinct personal information leaks affecting its Point Income points platform and the CoinTrade cryptocurrency exchange operated by its subsidiary Mercury.
On October 29, Ceres detected unauthorized external access to its system development environment. Subsequent investigation revealed that test and verification data stored temporarily in the environment had been viewed by third parties. The exposed records included a backup snapshot dated November 15, 2025, containing member information for roughly 11,100 individuals.
Exposed Data at Point Income
- Nicknames, registered email addresses, encrypted passwords, encrypted secret questions, dates of birth, and point balances at the time of the backup
- Phone numbers for 16 customers and one bank account name
- Four device identifiers (terminal IDs) assigned to smartphones and other devices
Ceres immediately blocked external access to the development environment and identified the intrusion path. Affected members have been contacted individually by email.
Separately, on November 2, Mercury received notification from its vendor Arara that the email delivery system repica had suffered a data leak. Investigation confirmed that email addresses of customers who received messages between October 8 and October 29 had been exposed. A total of 88,289 unique addresses were affected.
Mercury has suspended all email campaigns through the compromised service and is currently informing customers via its website. Individual notifications will resume once email delivery is restored. Both companies continue to demand detailed explanations from the vendors regarding the causes and remediation measures.
