US expected perfect banking SCAM storm causing by giant banking app leak!

Image source – freepik.com

Shortly, the Cooltechzone team found a hacker selling user information leaking from a banking application. This information consists in between such critical data as:

• default bank account ID,
• full name and address,
• app settings.

Let’s look at this case closely.

What has leaked?

Tentatively, we are talking about 7,52 million users exposed to this leak.

It is not yet clear how exactly the data looks like because there is no sample provided. But from the posted message, we assume that data is provided as strings of entries, where each line is assigned to a unique user. If it is not the case, then the number of affected users can be reduced.

We tried to contact the seller to receive few explanations, especially about the price and sample of data, but he didn't reply.

Despite the user has a relatively fresh registration, he was able to post few other threads about selling more users data, like presented below:

• 800,000 Chinese aircraft passengers;
• 3,69 million Chinese citizen data;
• Chinese government's private data.

How critical are the consequences of a data breach?

It is always difficult to predict the intentions of hackers who are going to buy leaked data and use it for malicious purposes.

Since we are talking about personal user's information, then it is most likely to speak about social engineering attacks, where banking scam calls are very realistic.

A few weeks ago, we already published another case of US fintech exposed 277 million records of their users, so we can not exclude that extracted database sold on the forum is only part of the breach and targeted banking app has other exposure interfaces, which are even more critical than just leaked information.

How can I protect my data online?

Every day millions of users entrust critical information to any third parties and services like financial services, and most often, they have no control over the security of their information, so they should rely on security measures and policies of corporations and service providers.

Cooltechzone team recommends following few basic principles to avoid falling victim to cybercriminals, even in the case of a third-party data breach.

1. I highly recommend using VPN services! VPN services don't let unauthorized users find out your real IP address and your geo-position based on that, so you can protect yourself from localization-based attacks.
2. Use only trustful services and providers. This will not be guaranteed 100% of data security, but the probability of data breach is much reduced in comparison with non-mature and suspicious cheap service providers.
3. Don’t disclose bank card details, addresses, phone numbers, and other confidential information on the Internet. Avoiding overexposure of your private data will reduce the threat of matching your identity by malicious actors to use this for further attack development.

Editor-in-Chief

Dmytro Cherkashyn

Being a passionate security expert from Ukraine, Dmytro has passed through various security domains for the last 12 years, starting with the physical security of nuclear facilities and coming to operational technology cybersecurity for critical infrastructure in Germany.