The state-run lender Punjab National Bank (PNB), just cannot seem to catch a break. According to a news report published by the Asia Times, an alleged data breach has compromised the sensitive details of as many as 10,000 debit and credit card customers of the bank.
According to the report, the card details have been up for sale for at least three months. The compromised data includes names, expiry dates, personal identification numbers (PINs) and card verification values (CVVs).
On Feb 20, Artificial intelligence-based data monitoring company, CloudSek issued a statement on its website, which said, “We identified a listing that claimed to have multiple cards that belonged to PNB that were put up for sale on a DarkWeb site.”
“On 22nd Feb, we provided them with a more detailed report. And the officials ensured swift action. It is the responsibility of the bank to validate and take necessary actions.” - CloudSek statement
CloudSek claims it has informed PNB security officials of the breach, and also provided a detailed report about the leaked data. “On Feb 22, we provided them with a more detailed report. And the officials ensured swift action.”
While PNB has not officially acknowledged the breach or issued a rebuttal, this should come as no surprise as banks are universally cagey about reporting instances of fraud and cyber-attacks.
Despite RBI’s missive to lenders that advises them to report cybersecurity breaches, banks prefer to ignore it and handle it internally, as such cases could lead to loss of reputation.
However, the threat intelligence company, CloudSek has also mentioned that anyone on the Darkweb can make any claims and advertisements, and that need not be true. The company has not verified whether the listed PNB data is authentic or not. “It is the responsibility of the bank to validate and take necessary actions,” the blogpost mentioned.
In the wake of the Nirav Modi saga, the Reserve Bank of India has tightened its regulatory by asking banks to integrate Society for Worldwide Interbank Financial Telecommunication (SWIFT) with core banking solutions (CBS).
The BFSI industry is a favorite among cybercriminals who are increasingly exploiting the SWIFT system to target banks globally. This is certainly not the first data breach for an Indian bank, and it will not be the last. From linking CBS to SWIFT, to disclosing data breaches – traditional lenders still have a long way to go.