While many associate financial hacks with stolen funds, recent incidents reveal a more complex landscape. Cybercriminals are increasingly targeting confidential employee information, which can lead to tailored phishing attacks, extortion, reputational harm, and internal disruptions within financial institutions. This blog continues our previous exploration of cybersecurity challenges in the banking and financial sector, focusing on recent breaches highlighting evolving threats to employees and customers.

The exposure of employee data—such as organizational roles, personal contact details, and work-related credentials—has become a lucrative asset for threat actors. This information enables attackers to craft convincing phishing campaigns, impersonate executives, and infiltrate critical systems. Beyond immediate financial risks, these breaches subject employees to extortion attempts, psychological distress, and potential damage to their professional reputations. Such scenarios not only harm individuals but also undermine trust in the organization as a whole.

For customers, the risks extend far beyond compromised accounts. Even when financial details remain secure, leaked personal information such as addresses, phone numbers, or account identifiers can enable identity theft and scams. Attackers often exploit this data to impersonate individuals, apply for loans, or facilitate broader fraud.

As these breaches grow in scale and sophistication, financial institutions face mounting pressure to safeguard not just customer accounts but the broader ecosystem of sensitive data. This analysis delves into recent breaches to shed light on these pressing issues and the proactive measures required to mitigate their impact.

Recent Financial Hacks & Breaches Analyzed by Constella Intelligence

1. VTB Bank – Customer Database Breach

A post on an underground forum claims to offer data allegedly linked to VTB Bank in Russia, including over 1.9 million unique email addresses. The exposed data includes personal identifiers critical for launching identity theft or phishing attacks. Given the breadth of data compromised, customers and employees alike are at risk of targeted fraud and scams.

Exposed Fields:

• Names
• Emails
• Phone numbers
• Physical addresses
• Dates of birth

2. Izipay – Customer Data Breach

Izipay, a major payment processor in Peru, appears to have been impacted by a breach exposing 1.8 million unique email addresses. The compromised information encompasses extensive details about merchants, making this breach highly impactful. The data exposed is ripe for targeted attacks, including fraud schemes, impersonation, and extortion.

Exposed Fields:

• Customer codes
• Account information
• Company names
• Operational details
• Email addresses
• Phone numbers
• Regional identifiers
• Transaction data
• Administrative records

3. Interbank – Customer Database Breach

A user on a dark web platform has shared a post alleging that Peru’s Interbank was affected by a breach exposing over 1.7 million unique email addresses. The compromised information includes sensitive personal and account-related data, which attackers could exploit to defraud customers or execute targeted phishing campaigns.

Exposed Fields:

• Full names
• Account IDs / National IDs
• Birth dates
• Addresses
• Phone numbers
• Email addresses
• IP addresses
• Credit card information

4. Bank of America – Employee Directory Breach

In the United States, Bank of America reportedly experienced a breach tied to the MOVEit vulnerability, compromising more than 280k unique emails. The breach exposed extensive employee directory information, making it a prime target for attackers seeking to craft social engineering schemes. The detailed organizational data presents significant risks, including impersonation of high-ranking officials and exploitation of internal processes for financial gain.

Exposed Fields:

• Employee codes
• Login IDs
• Full names
• Email addresses
• Phone numbers
• Job titles
• Detailed organizational information

5. PrivatBank – Customer Data Leak

Data sets allegedly tied to Ukraine’s PrivatBank, including over 400 unique emails and 237 million records, are being offered for sale online. While the number of email addresses found was low, the leak’s volume and the type of data—personal identifiers like passports and full names—pose a severe risk. Cybercriminals can use this information for identity theft, document forgery, or large-scale fraudulent activities.

Exposed Fields:

• Login IDs & Emails
• Full names
• Phone numbers
• Passport information

Conclusion

These breaches illustrate the growing sophistication of cyber threats targeting financial institutions. While direct financial theft remains a concern, the exposure of employee and customer data introduces new risks, including identity theft, extortion, and reputational damage. Addressing these challenges requires proactive and comprehensive cybersecurity measures.

Increase in Cryptocurrency Leaks After Trump Supports Bitcoin

Recently, Constella Intelligence has observed an increase in attacks and data breaches resulting in cryptocurrency leaks. This surge could be partly attributed to comments made by former President Donald Trump in support of Bitcoin, which may have heightened hackers’ interest in these sites.

Former President Donald Trump has recently positioned himself as a pro-crypto presidential candidate. During his keynote speech at the Bitcoin 2024 conference in Nashville, Tennessee, held from July 25-27, 2024, Trump emphasized the transformative potential of cryptocurrencies. He pledged to make the United States a leader in Bitcoin mining and digital asset management.

These comments could have caused crypto-related sites to increase in value, making them more attractive targets for cybercriminals. As Bitcoin prices surge, the incentive for attacks on these platforms grows, highlighting the need for robust security measures.

Crypto Leaks Overview

In the first half of 2024, over 250 possible breaches or leaks related to cryptocurrencies, NFTs, and Bitcoin have been reported. These potential breaches could have affected users of various cryptocurrency platforms, including Bitcointalk, Crypto.com, Binance, eToro, and others.

Below are examples of how threat actors are offering information about these crypto-related sites on the Dark Web

Zuelacoin Data Leak:

This information was published on March 31, 2024. According to the threat actor the data includes:

• Emails
• Names
• Social media profiles (Twitter, Facebook, Telegram)

Binance Cryptocurrency Leak:

The post was made on May 27, 2024. The exposed information includes:

• Emails
• Full names
• Phones
• Countries

Mobile Apps like CashCoin, Coinbase, and KuCoin:

The threat actor “whix” published this on March 26, 2024. The exposed information includes:

• Emails
• Usernames
• Passwords
• Countries
• IP Addresses
• Payment methods

eToro Cryptocurrency Leak:

The same threat actor also reported this on March 25, 202, where the following information could be found:

• Full names
• Emails
• Countries
• IP Addresses
• Amounts
• Payment methods

Bitcointalk Cryptocurrency Leak:

According to the threat actor on March 25, 2024, a database exposing the following information was published:

• Emails
• Usernames
• Ethereum Addresses

These platforms are integral to the crypto ecosystem, providing services such as trading, wallet management, and social interaction for crypto enthusiasts.

Extent of Infostealer Exposures

Constella Intelligence has checked if the information published could have been produced as the effect of infostealer infections. This check resulted in nearly 4 million users of these cryptocurrency companies being exposed to infostealer data. Most exposures have impacted major cryptocurrency exchange platforms:

1. Binance: More than 2M users exposed.
2. EToro: More than 500k users exposed.
3. Crypto.com: More than 300k users exposed.
4. Localbitcoins: More than 200k users exposed.

Digging into the infostealer exposures, Constella Intelligence also identified what seems to be infostealer infections of potential employees of some of those companies, including Binance.com, eToro.com, Crypto.com, and Localbitcoins.com, among others.

Implications of Crypto-Related Breaches

The exposure of such extensive and sensitive information has significant and far-reaching implications as it endangers the financial security and privacy of millions of users. The compromised data can be exploited for various malicious activities:

1. Identity Theft: Personal information such as full names, addresses, and birthdays can be used to steal identities.
2. Financial Fraud: Payment methods and transaction histories can be exploited to conduct unauthorized transactions.
3. Phishing Attacks: Email addresses and social media profiles can be used to create convincing phishing scams.

Recommendations for Users

To mitigate the risks associated with the recent breaches, users should adopt the following security practices:

1. Use Strong, Unique Passwords: Ensure that each cryptocurrency account has a strong, unique password. Consider using a password manager to generate and store complex passwords securely.
2. Enable Two-Factor Authentication (2FA): Adding an extra layer of security through 2FA can significantly reduce the risk of unauthorized access to accounts.
3. Monitor Crypto Transactions Regularly: Keep a close watch on your cryptocurrency transactions and wallet activity to detect any unauthorized activities. Early detection can help prevent significant financial losses.
4. Be Wary of Phishing Attempts: Be cautious with emails and messages requesting personal information or directing you to log in to your accounts. Verify the authenticity of such requests through official channels.
5. Update Security Settings on Crypto Platforms: Regularly review and update your security settings on cryptocurrency exchanges and wallets. Ensure that all recovery options are up-to-date and secure.