Data on 12 million clients of Russian MFIs put up for sale

[НСК-СБ]

Data on 12 million clients of Russian MFIs put up for sale

09:49 / 29 April, 2020


The seller offers full name, passport details, dates of birth, phone numbers and other personal information.

At the cybercrime forum, the data on the Russians who issued loans in microfinance organizations in 2017-2019 were put up for sale. According to the seller, the database contains information about 12 million people. He also offers a free “sampler” - full name, passport data, dates of birth, phone numbers, email addresses, regions of residence, electronic wallet numbers and loan amounts of 1.8 thousand citizens.

Each data set also contains a link to a site through which the borrower learned about the microfinance organization. According to RBC, in most cases this is the Unicom24 financial market for searching and obtaining loans, microloans, mortgages, etc. Market representatives checked the “probe” and confirmed that the customer identification code indicated in the database being sold belongs to one of their partners, but did not specify to whom exactly. According to them, Unikom24 has already turned to this company with a demand to clarify the situation and a notice of termination of cooperation.

According to Unikom24, most likely, the microfinance organization (MFI) itself became the source of the leak. When applying for a loan, the system requests only a full name and a valid phone number, representatives of the market explained. Passport data, email addresses, loan amounts and other information are known only to MFIs, from which the borrower asks for a loan. However, when a RBC correspondent submitted a loan application through Unicom24, in addition to the name and telephone number, the system also requested passport data and date of birth.

На продажу выставлены данные 12 млн клиентов российских МФО

Продавец предлагает ФИО, паспортные данные, даты рождения, номера телефонов и другую персональную информацию.

www.securitylab.ru

 

[Виталий]

Did you also agree to the processing of this personal data for sale? )))

 

[НСК-СБ]

CyberExpert spoke about the use of stolen data

April 29, 2020, 13:31

Photo: Izvestia / Zurab Javakhadze

The personal data of citizens that fell into the hands of cyber fraudsters can be used in attacks using social engineering methods, head of Positive Technologies’s information security analytics department Yevgeny Gnedin told Izvestia on April 29 . The company specializes in the development of information security software.

Earlier this day, it was reported that the Network leaked data of microloans issued in 2017-2019 by Russians. According to the seller, there are 12 million entries in the database with passport numbers, phones and information about electronic wallets. One of the MFIs could have leaked.



Fools and thieves: their employees have become more dangerous than hackers

10 billion user data records were compromised over the year by company staff
“The more criminal information the person has, the more believable legend the attacker can build in conversation with the victim. For example, he will be able to introduce himself as an employee of a financial organization and try to find out some additional information from the victim - bank card data, scans of documents and other additional information that is needed for fraudulent operations on behalf of the victim, ”said Eugene Gnedin.

Also, data from the database can be used in targeted advertising companies, for example, on the provision of loans.

According to a cyber expert, it is impossible for ordinary citizens to protect themselves from such leaks. If they provided their data to the organization, then from now on they can only rely on the reliability of their storage on the side of the company.

“Unfortunately, today databases are often leaked through the fault of insiders, and as a result of external cyberattacks, and due to obvious administrative errors, for example, when databases that are not password protected become accessible from the Internet. Citizens need only be more attentive to the organizations to which they provide their data, not to contact companies that they are not sure of reliability, ”concluded Positive Technologies, the head of information security analytics department.

In early February on the Internet turned out to be Alfa-credit loan broker customer base providing assistance in obtaining loans. The data was freely available for only a few days.

In the same month it became known Estee Lauder base leak. As a result, more than 440 million records of buyers of cosmetic products and various internal documents were published.

Киберэксперт рассказал о применении ворованных данных

Попавшие в руки кибермошенников персональные данные граждан могут быть использованы в атаках методами социальной инженерии, рассказал «Известиям» руководитель отдела аналитики информационной безопасности компании Positive Technologies Евгений Гнедин 29 апреля. Предприятие специализируется на...

iz.ru

 

[Матушкин Андрей Николаевич]

CyberExpert spoke about the use of stolen data

Thank!