ShinyHunters Breach Exposes Vietnam’s Credit Data

Vietnam’s National Credit Information Center (CIC), managed by the State Bank of Vietnam, is investigating a major cyberattack that reportedly exposed more than 160 million records.

Authorities confirmed that the incident involved unauthorized access aimed at stealing personal data, though CIC says its operations and credit reporting services remain functional. The breach has been linked to the hacker collective ShinyHunters, which has previously been behind large-scale data thefts.

According to Resecurity, the stolen dataset includes names, government and tax identification numbers, addresses, contact details, employment histories, and detailed credit records. While some financial data, such as credit card information, was encrypted, personally identifiable information was left exposed in plaintext.

Investigators believe the dataset is historic and comprehensive, with duplication across years of records. Given that Vietnam’s population is under 102 million, the reported figure of 160 million leaked records suggests that multiple entries per individual are included, covering both past and current financial information. Resecurity noted that the attackers are attempting to monetize the stolen data through underground forums rather than issuing ransom demands.

The CIC has alerted banks and creditors to the incident, warning that ShinyHunters may already be distributing the data across illicit marketplaces. The compromise poses significant risks of identity theft, loan fraud, and targeted phishing attacks, as criminals could exploit exposed identification and financial details to impersonate victims or gain unauthorized access to accounts. Analysts also warn that breaches of centralized repositories like CIC threaten systemic trust in financial institutions, potentially driving higher security costs and undermining confidence in Vietnam’s banking system.

Vietnam’s cybersecurity agency, along with state-owned technology partners, is working to identify how the attackers gained access and to prevent further exposure. While officials emphasize that the credit system remains operational, the scope of the breach raises questions about the resilience of critical financial infrastructure and the risks associated with maintaining vast centralized databases of sensitive information.