Technology: Vietnam’s national credit registry hacked, exposing data of most citizens
Vietnam’s National Credit Information Center (CIC), the government agency that manages the country’s credit database, was hacked earlier this week, as reported by DataBreaches.net September 8 and confirmed by the Government Electronic Newspaper on September 11.
DataBreaches first disclosed the breach, reporting that hackers obtained databases containing national ID numbers, dates of birth, contact details, credit histories, and financial records.
The site said “most of the population” may have been affected, calling it one of the most extensive exposures of national credit data to date
As part of its reporting, DataBreaches.net interviewed the hacker group ShinyHunters, who claimed responsibility for the attack.
ShinyHunters said they chose CIC “because it held a massive amount of data,” estimating “the total amount of records across all tables was like 3 billion or more.”
They said they gained access using an n-day exploit, a cyberattack method that targets a known software vulnerability after disclosure but before the victim applies a fix.
When asked whether CIC could have patched the flaw, the group replied that “there was no actual patch available, as the software was end-of-life”, meaning the vendor had stopped releasing updates or security fixes, leaving systems permanently vulnerable.
The Government’s Electronic Newspaper later confirmed the incident, citing the Vietnam Cyber Emergency Response Team (VNCERT).
According to the outlet, VNCERT detected cybercriminal intrusion into CIC systems on September 10 and found evidence of attempts to steal personal data.
Officials continue to verify how much information was compromised in the attack.
VNCERT has warned, through the government outlet, that individuals must not download, share, or use leaked data and stressed that violations would face penalties under Vietnamese law.
It urged banks, financial institutions, and government agencies to strengthen defences in line with national cybersecurity standards. It also advised citizens to remain alert to fraud, phishing, and malware risks.
