Vietnam's National Credit Information Center hit by cyberattack exposing over 160 million records
Learn More
The Vietnam National Credit Information Center (CIC), operated under the State Bank of Vietnam, was hit by a cyberattack that potentially compromised the personal and financial information.
The breach was confirmed by the Vietnam Cyber Emergency Response Team (VNCERT) on September 12, 2025, following initial reports received on September 10, 2025, about unauthorized access to the national credit database.
The cyberattack was claimed by the ShinyHunters hacker group. The group allegedly gained unauthorized access to CIC's systems using an exploit that targeted end-of-life software for which no security patch was available. The hackers boasting in closed Telegram channels that Vietnam was "taken in 24 hours."
The exposed data includes:
- General personally identifiable information (PII)
- Credit payment histories and records
- Risk analysis data
- Credit card information (requiring decryption of the FDE algorithm)
- Tax identification numbers
- Military identification documents
- Government-issued identification numbers
- Income statements and financial records
- Debt information and obligations
- Historical credit data spanning multiple years
Update - The State Bank of Vietnam (SBV) stated that the CIC database does not include sensitive personal information such as: deposit accounts, account balances, savings passbooks, payment accounts, debit card numbers, credit card numbers, security codes (CVV/CVC), or customer transaction history.
Vietnamese authorities have not yet disclosed the exact number of affected individuals. The hackers suggested that nearly the entire Vietnamese population could be impacted, noting that the dataset included historical data spanning multiple years. Vietnam's total population is approximately 102 million people.
Given that some part of the population lives in rural areas with limited use of financial services and at least one quarter of the population is under 18, the number of exposed individuals would at most be about 50 million.
Vietnamese authorities immediately activated emergency response protocols. Technical and investigative measures have been deployed to contain the breach, verify its scope, and safeguard the integrity of national financial systems.
VNCERT has issued strict warnings to all individuals and organizations, urging them not to download, share, or exploit any leaked data, with violations to be handled according to Vietnamese data protection and cybersecurity laws. Financial institutions and banks have been ordered to audit their systems and ensure compliance with national cybersecurity standard TCVN 14423:2025. Citizens are advised to be careful of online scams, phishing attempts, and malware distribution schemes that may exploit the stolen information.
Update - The State Bank of Vietnam (SBV) stated that the CIC database does not include sensitive personal information such as: deposit accounts, account balances, savings passbooks, payment accounts, debit card numbers, credit card numbers, security codes (CVV/CVC), or customer transaction history.
