In early 2025, the Bangladesh Cyber Security Intelligence (BCSI) discovered that a threat actor had been selling City Bank’s financial statements on underground hacking forums. This breach, which exposed sensitive client data, raised serious concerns about the cybersecurity practices of financial institutions in Bangladesh. The discovery was made after BCSI was alerted by a CS-CERT contributor in December 2024, who informed them that the bank’s client information was being sold for monetary gain.
BCSI had previously warned City Bank in mid-2024 about significant vulnerabilities in their system. At the time, the researchers demonstrated how attackers could exploit these weaknesses to access sensitive client information and potentially withdraw funds. Although City Bank quickly addressed the immediate issues, it became clear that the bank had not fully secured its systems, leading to the eventual breach. The BCSI investigation confirmed the legitimacy of the threat actor’s claims and identified the vulnerability exploited in the attack.
The breach was traced back to a weakness in the system’s session management, which allowed attackers to bypass multi-factor authentication. Once the attacker logged in, the session tokens were not properly invalidated, enabling them to reuse the tokens and gain unauthorized access to other accounts. This oversight allowed the threat actor to access City Bank customers’ statements without needing further authentication, highlighting a critical flaw in the bank’s cybersecurity practices. Despite traditional pentesting practices, which are commonly used to identify vulnerabilities, the bank’s security measures were deemed inadequate to detect such a flaw.
In response to the breach, BCSI informed City Bank of the vulnerability, prompting the bank to act quickly and resolve the issue. By January 3, 2025, the bank had patched the vulnerability, but the incident served as a stark reminder of the importance of strong cybersecurity measures. BCSI emphasized the need for better security practices within the financial sector, including stronger access controls, network security, continuous monitoring, and third-party risk management. These actions are crucial to reducing the risk of cyberattacks and protecting sensitive financial data from unauthorized access.
Reference:
