India-based cybersecurity start-up Technisanct has stumbled upon a series of breached data involving hundreds of thousands of payment card details from six major Southeast Asian countries including Malaysia and Singapore.
The data dumps were found in various dark-web forums where they were put on sale, which included CVV, expiry dates and in some cases PIN numbers of payment cards.
As reported by South China Morning Post, the breached cards belong to top banks in Malaysia, Singapore, the Philippines, Vietnam, Indonesia, and Thailand. These breaches were uncovered during a research exercise conducted by threat analysis team to analyse threats to the financial sector in the Southeast Asian countries, the company said in an official statement.
Technisanct found credit card holders in the Philippines the worst hit—with 172,828 breached cards followed by Malaysian (37,145) and Indonesia (35,354). The company first posted its findings in February.
“The results are alarming as it seems no one is aware that such a huge volume of payment card details – including the CVV and PIN – are available,” said CEO Nandakishore Harikumar, referring to the card verification value and personal identification number.
Nandakishore revealed that he had emailed the Computer Emergency Response Team (CERT) in each country and advised them to take action, although not all had responded.
The cybersecurity company also highlighted that the value of the breached data sold on the dark-web depended on the individual bank balance of the card—the higher the balance, the higher the price of the card.
Researchers believe that these numbers may have been collected via phishing, malware, or through fraudulent apps or POS machines.
I’ve reached out to myCERT, NACSA, VISA, Mastercard, and local banks for comments.
