Seychelles Commercial Bank on Friday said it had recently identified and contained a cybersecurity incident.
A hacker claims to have stolen and sold the personal data of clients of Seychelles Commercial Bank. The bank, which provides personal and corporate services on Seychelles, one of the world’s smallest countries, notified customers of a hack, but said only personal information – not money – was stolen.
Seychelles Commercial Bank on Friday said it “recently identified and contained a cybersecurity incident, which has resulted in its internet banking services being temporarily suspended,” and requested customers “make use of our ATMs or visit one of our branches during normal banking hours.”
In its breach notification, the bank told customers: “SCB regrets to inform that this cyber incident resulted in unintentional exposure of personal information of internet banking customers only. The bank reassures all its internet banking customers that no funds have been accessed.”
Researchers at Los Angeles-based cybersecurity firm Resecurity engaged with the attacker, and reviewed a sample of stolen data. They said it appears to contain numerous customer names, email addresses, phone numbers, type of account and account balances. Multiple accounts are also labeled “current accounts – government.”
In reporting by OCCRP, the Central Bank of Seychelles confirmed in an e-mail that it has been formally notified by the Seychelles Commercial Bank of its recent cybersecurity incident.
The breach could be notable because of the Seychelles’ approach to tax liability pertaining to bank deposits. Based on the jurisdiction’s laws and regulations, the Seychelles “currently ranks 45th on the Corporate Tax Haven Index, which ranks the world’s biggest enablers of global corporate tax abuse,” says the Tax Justice Network.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
Pierluigi Paganini
(SecurityAffairs – hacking, Seychelles Commercial Bank)