Web3 financial platform Based discovered that an unauthorized third party had accessed an internal dashboard used to manage the Based Visa Card program and contained the incident shortly after detection. KYC data collected by the card issuer for some cardholders (including name, ID/passport number, date of birth, and address) may have been obtained. Card numbers, CVV, PIN, ID photos, liveness records, the Based Wallet, and card funds were not affected, and cards continue to work normally. Affected users were notified by email, authorities were informed, and users were warned about phishing and social-engineering risks.