Gopax disclosed a security breach that began in September 2026 and went undetected until early October 2026, leaking personal data belonging to seven customers and two staff members