Vietnam creditors hit by cyberattack - sensitive data at risk

• Vietnam confirms cyberattack on national credit data center is being investigated
• CIC says systems still operational despite hacker intrusion into creditor database
• Authorities suspect Shiny Hunters group is behind the system breach

Vietnam’s National Credit Information Center (CIC), which operates under the State Bank of Vietnam, has confirmed a cyberattack that may have exposed sensitive creditor information.

According to Reuters, the scope of the breach remains unclear for now.

Investigators said in a statement, "Initial investigation indicated signs of unauthorized access aimed at stealing personal data, with the extent of the breach still being assessed.”

Shiny Hunters

The Vietnam Cybersecurity Emergency Response Center (VNCERT) said it received a report from CIC about the incident on September 11.

“The incident has not disrupted operations or caused any damage, and the credit information service system remains fully functional,” CIC said in a letter sent to financial institutions.

The letter, which Reuters says it has seen, additionally suggested the attack may have been carried out by Shiny Hunters, a hacking group known for breaching major firms including Google, Microsoft, and Qantas.

Vietnam’s Department of Cybersecurity and High-Tech Crime Prevention has reportedly directed VNCERT to work with CIC, the central bank, and leading cybersecurity companies such as Viettel, VNPT, and NCS.

Evidence is currently being gathered and technical safeguards have been activated in order to protect national financial data systems.

VNCERT also warned individuals and organizations not to download or distribute leaked data, stressing that any violations will face stern legal repercussions.

The State Bank of Vietnam has not commented on the breach, while investment bank JPMorgan said in a note to investors that the incident could raise cybersecurity costs for local banks, although it did not expect an immediate impact on deposit flows.

Cybersecurity expert Ngô Minh Hiếu said in a post on Meta that banks like CIC do not store credit card numbers, one-time passwords, or login details, meaning key financial data, such as transactions and credit card information will not be affected or compromised.

Vietnam’s authorities continue to monitor the situation as they work to determine the scale of the attack.

You might also like

• Cybersecurity is now critical for business growth, CEOs say
• Six ways banks can ensure watertight cybersecurity in a hostile digital world
• US banks don't want to have to reveal when they've been hacked