According to the police investigation, Tam used the phone number 096123... to open a payment account at a bank in Ho Chi Minh City. In May 2023, Tam used this bank's application, entered the account number (registered) on the phone. Tam continued to open an online savings book on the application with a value of 1 million VND. According to the bank's regulations, with his 1 million VND savings book, Tam could borrow 850,000 VND. However, Tam used technology to illegally interfere with the financial information system of this bank, editing the code of the collateral asset, a savings book worth 1 million VND, to more than 51 billion VND. From May 23 to June 9, Tam intervened in the banking system 7 times, withdrawing and transferring to his personal account with a total amount of more than 10.5 billion VND (then transferred 500 million VND back to the bank). Tam withdrew 6.5 billion VND, the remaining amount was discovered and frozen by the bank before he could withdraw it.

Comments from technology experts

Commenting on this cyber attack, Mr. Vu Ngoc Son, Chief Technology Officer (CTO) of NCS Company, said that the case is currently being investigated by the police, so there is no exact information about how the hackers infiltrated the system.

Based on initial information, Mr. Son guessed that the hacker might have exploited a vulnerability in a component of the bank's system, thereby interfering with the mortgage asset management system to edit data. This is a rather rare case because the hacker edited data directly related to his personal loans and accounts. Therefore, it is possible to detect it only by relying on the transaction history log on the system. In the past, there have been many cases of hackers attacking banks, then using other people's accounts and transferring money through many intermediary banks, making detection, investigation, and asset recovery more difficult and complicated.

Mr. Son added: "Currently, banks are equipped with systems to monitor unusual transactions, as well as SOC systems to monitor and detect cyber attacks, so detection is only a matter of time. If detected early, the consequences will generally be reduced. To prevent similar cases, banks need to strengthen the review of system vulnerabilities, strengthen network security monitoring and monitor unusual transactions to quickly detect incidents and handle them promptly."

Sharing with Thanh Nien about the above incident, Ms. Vo Duong Tu Diem - Director of Kaspersky Vietnam, commented that the hacker's actions were interference, causing damage to the system and possibly creating potential vulnerabilities, creating opportunities for other hackers to break in. If the bank had responded promptly to this incident, the data of other customers would not have been affected. In the opposite situation, the consequences could be that users suffer financial and identity losses.

For users of online payment services, Kaspersky offers advice to help avoid becoming a victim of hackers, first using virtual cards for online payments, blocking old cards and using new ones at least once a year. Users should also set low payment limits on payment cards or keep low balances, and ensure that banks always require online payment confirmation using one-time codes (OTP), 3D security or similar mechanisms.

To avoid becoming a victim of hackers, users should carefully check payment methods and website addresses before entering financial information. It is best to use cybersecurity solutions such as security applications, anti-virus... to help protect online payments.