Maze Ransomware operators claim to have hacked the network of the state-owned Bank of Costa Rica Banco BCR and to have stolen internal data, including 11 million credit card credentials.
Banco BCR has equity of $806,606,710 and assets of $7,607,483,881, it is one of the most solid banks in Central America.
The hackers claim to have compromised the Banco BCR’s network in August 2019, and had the opportunity to exfiltrate its information before encrypting the files.
According to Maze, the bank’s network remained unsecured at least since February 2020.
Anyway, the group explained that they did not encrypt the bank documents in February, because it “was at least incorrect during the world pandemic”.
The stolen data includes 4 million unique credit card records, and 140,000 allegedly belonging to USA citizens.
“The ransomware operators claim to have over 11 million credit card credentials, of which over 4 million are unique and 140,000 belong to the US citizens.” reads a post published by Cyble.
“The Cyble Research Team has verified this press release in which the ransomware operators state that they executed this data breach to alert people about the poor security measures being installed by these big financial institutions. Above that, the ransomware operators also state that they would publish all the details of over 11 million credit card numbers on their website if they do not receive any feedback about the installation of high-security measures by Banco BCR.”
Maze ransomware operators posted 240 credit card numbers as a proof of the hack (they removed the last four digits) and related expiration dates and credit card verification codes (CVC).
Banco BCR cardholders are recommended to contact the bank to determine if their data have been compromised and request for a free monitoring service for fraudulent charges.
Banco BCR has yet to disclose the security breach.
Please vote Security Affairs for European Cybersecurity Blogger Awards – VOTE FOR YOUR WINNERS
(SecurityAffairs – Banco BCR, hacking)
Necessary cookies are absolutely essential for the website to function properly. This category only includes cookies that ensures basic functionalities and security features of the website. These cookies do not store any personal information.
Any cookies that may not be particularly necessary for the website to function and is used specifically to collect user personal data via analytics, ads, other embedded contents are termed as non-necessary cookies. It is mandatory to procure user consent prior to running these cookies on your website.