Vietnam warns of major data theft after credit center hacked

Authorities warned individuals and organizations against downloading, sharing or exploiting leaked data, saying violators will face legal action

Vietnam said a cyberattack on the National Credit Information Center could have led to a major breach of personal data and warned the public to be on alert as it investigates the scale of the threat.

The national cyberresponse team is taking emergency measures to deal with the incident, the government said on its website. Authorities are working with the central bank and other agencies to contain the breach and secure the systems of the credit center, known as CIC.

A hacker group known as ShinyHunters is likely behind the attack, CIC told financial institutions including foreign and domestic banks in a letter seen by Bloomberg News. The group had said on an online forum it had obtained national credit information and offered it for sale, according to the letter.

The CIC is under the State Bank of Vietnam and operates as the country’s central credit bureau, collecting and providing credit information on individuals and businesses to support lending decisions across the financial system. So far no disruption or damage has been caused and credit services remain fully operational, CIC said in the letter. CIC representatives didn’t immediately respond to a request for comment.

“If the attackers’ claims are accurate, this incident affects almost the entire adult population of Vietnam — exposing government IDs, tax records, and financial histories in one sweep,” said Pete Renals of the cybersecurity firm Palo Alto Networks Inc. That creates an unprecedented risk of identity theft and fraud potentially for years to come, Renals said.

Authorities warned individuals and organizations against downloading, sharing or exploiting leaked data, saying violators will face legal action. Officials also urged local and foreign banks and other financial institutions to tighten cybersecurity in line with national standards.

ShinyHunters is among several cybercrime groups with a history of attacking large organizations. It has claimed to steal data from Google, Microsoft Corp., the news website Mashable and the clothing brand Bonobos in recent years.

“Events like these often serve as a wake-up call, mobilizing nations to re-evaluate their cybersecurity posture, practices, and long-term investment,” said Renals.