Menu

  • Alerts
  • Incidents
  • News
  • APTs
  • Cyber Decoded
  • Cyber Hygiene
  • Cyber Review
  • Cyber Tips
  • Definitions
  • Malware
  • Threat Actors
  • Tutorials

Useful Tools

  • Password generator
  • Report an incident
  • Report to authorities
No Result
View All Result
CTF Hack Havoc
CyberMaterial
  • Education
    • Cyber Decoded
    • Definitions
  • Information
    • Alerts
    • Incidents
    • News
  • Insights
    • Cyber Hygiene
    • Cyber Review
    • Tips
    • Tutorials
  • Support
    • Contact Us
    • Report an incident
  • About
    • About Us
    • Advertise with us
Get Help
Hall of Hacks
  • Education
    • Cyber Decoded
    • Definitions
  • Information
    • Alerts
    • Incidents
    • News
  • Insights
    • Cyber Hygiene
    • Cyber Review
    • Tips
    • Tutorials
  • Support
    • Contact Us
    • Report an incident
  • About
    • About Us
    • Advertise with us
Get Help
No Result
View All Result
Hall of Hacks
CyberMaterial
No Result
View All Result
Home Incidents

City Bank Cyber Breach Exposes Client Data

January 7, 2025
Reading Time: 2 mins read
in Incidents
City Bank Cyber Breach Exposes Client Data

In early 2025, the Bangladesh Cyber Security Intelligence (BCSI) discovered that a threat actor had been selling City Bank’s financial statements on underground hacking forums. This breach, which exposed sensitive client data, raised serious concerns about the cybersecurity practices of financial institutions in Bangladesh. The discovery was made after BCSI was alerted by a CS-CERT contributor in December 2024, who informed them that the bank’s client information was being sold for monetary gain.

BCSI had previously warned City Bank in mid-2024 about significant vulnerabilities in their system. At the time, the researchers demonstrated how attackers could exploit these weaknesses to access sensitive client information and potentially withdraw funds. Although City Bank quickly addressed the immediate issues, it became clear that the bank had not fully secured its systems, leading to the eventual breach. The BCSI investigation confirmed the legitimacy of the threat actor’s claims and identified the vulnerability exploited in the attack.

The breach was traced back to a weakness in the system’s session management, which allowed attackers to bypass multi-factor authentication. Once the attacker logged in, the session tokens were not properly invalidated, enabling them to reuse the tokens and gain unauthorized access to other accounts. This oversight allowed the threat actor to access City Bank customers’ statements without needing further authentication, highlighting a critical flaw in the bank’s cybersecurity practices. Despite traditional pentesting practices, which are commonly used to identify vulnerabilities, the bank’s security measures were deemed inadequate to detect such a flaw.

In response to the breach, BCSI informed City Bank of the vulnerability, prompting the bank to act quickly and resolve the issue. By January 3, 2025, the bank had patched the vulnerability, but the incident served as a stark reminder of the importance of strong cybersecurity measures. BCSI emphasized the need for better security practices within the financial sector, including stronger access controls, network security, continuous monitoring, and third-party risk management. These actions are crucial to reducing the risk of cyberattacks and protecting sensitive financial data from unauthorized access.

Reference:

  • City Bank Breach Exposes Sensitive Client Data Sold on Underground Forums
Tags: City Bankcyber incidentsCyber Incidents 2025CyberattackData BreachesJanuary 2025
ADVERTISEMENT

Related Posts

Infostealer Hidden in Steam Game

Hackers Target Amazon’s AI Code Bot

July 25, 2025
Infostealer Hidden in Steam Game

APTs Use Fake Dalai Lama Apps to Spy

July 25, 2025
Infostealer Hidden in Steam Game

Infostealer Hidden in Steam Game

July 25, 2025
Interlock Ransomware Threat Alert

Hackers Use Ransomware on SharePoint Servers

July 24, 2025
Interlock Ransomware Threat Alert

Data Breach Affects 340K Jobseekers

July 24, 2025
Interlock Ransomware Threat Alert

Beluga Vodka Ransomware Attack Reported

July 24, 2025

Latest Alerts

CastleLoader Uses Clickfix on Windows

Sophos, SonicWall Patch Critical RCE Bugs

Koske Malware Hides in Panda Images

Interlock Ransomware Threat Alert

GitLab Patches Key Vulnerabilities

Backdoor Found in WP Plugins

Subscribe to our newsletter

    Latest Incidents

    Hackers Target Amazon’s AI Code Bot

    APTs Use Fake Dalai Lama Apps to Spy

    Infostealer Hidden in Steam Game

    Data Breach Affects 340K Jobseekers

    Hackers Use Ransomware on SharePoint Servers

    Beluga Vodka Ransomware Attack Reported

    CyberMaterial Logo
    • About Us
    • Contact Us
    • Jobs
    • Legal and Privacy Policy
    • Site Map

    © 2025 | CyberMaterial | All rights reserved

    Welcome Back!

    Login to your account below

    Forgotten Password?

    Retrieve your password

    Please enter your username or email address to reset your password.

    Log In

    Add New Playlist

    No Result
    View All Result
    • Alerts
    • Incidents
    • News
    • Cyber Decoded
    • Cyber Hygiene
    • Cyber Review
    • Definitions
    • Malware
    • Cyber Tips
    • Tutorials
    • Advanced Persistent Threats
    • Threat Actors
    • Report an incident
    • Password Generator
    • About Us
    • Contact Us
    • Advertise with us

    Copyright © 2025 CyberMaterial