Vietnam's central bank confirms cyber security incident at National Credit Information Center

The State Bank of Vietnam (SBV) on Friday confirmed there was a credit information incident at the National Credit Information Center of Vietnam (CIC).

In a press release, the central bank noted that CIC is one of four organizations licensed to provide credit information services in Vietnam.

"Credit information collected by CIC according to the law does not include information about deposit accounts, deposit balances, savings books, payment accounts, debit card numbers, credit card numbers, security codes (card verification value/code or CVV/CVC), and customer payment transaction history," it noted.

"The information technology systems of independent credit institutions and the service provision activities of credit institutions are currently being implemented continuously, safely, and stably," the SBV added.

Previously, on Thursday, the Vietnam Cyber Emergency Response Center (VNCERT) announced that it had received a report of a cyber security incident occurring at the CIC and initial reports show "signs of personal data breach".

"Initial verification results show signs of cybercrime attacks and intrusions with the aim of stealing personal data. The amount of illegally acquired data is still being counted and clarified," the government's news portal quoted VNCERT as saying.

VNCERT is under the Department of Information Security of the Ministry of Science and Technology.

The SBV's press release stressed that illegal collection, processing, exploitation, use, exchange and provision of credit information will be handled according to the law.

It recommends that customers comply with the law and instructions/recommendations of competent authorities on safety and security; follow the regulations, instructions and recommendations of credit institutions to protect their rights and interests; and avoid being exploited by "bad people" to spread malware, commit fraud, and appropriate property.

On Thursday, the SBV required credit institutions and payment intermediaries to assess information security and promptly fix existing system loopholes.

The request was sent in written to credit institutions, payment intermediary service providers, credit information service providers, Deposit Insurance, National Payment Corporation of Vietnam (Napas), and National Credit Information Center of Vietnam (CIC).

Cybersecurity expert Hieu PC (Ngo Minh Hieu) had said earlier that banks did not send credit card information (including card numbers, expiration dates, CVV/CVC code) to the CIC system, so customers' credit card transactions were not affected by this incident.

At the same time, he warned of the risk of criminals taking advantage of the confusion to spread fake news and scams to steal personal information.