Skip to main content

Top digital loan firm security slip-up puts data of 36 million users at risk

Web Hosting & Remote IT Support
  • Indian loan company Vivifi has reportedly suffered a data breach
  • 36 million files were left exposed
  • These consisted primarily of personally identifiable information (PII)

A leading digital lending app has apparently exposed sensitive customer data after a misconfigured Amazon AWS S3 was bucket left unsecured without authentication.

Cybernews researchers discovered loan provider Vivifi left 36 million files of Know Your Customer (KYC) documents open online. The primary risk after a data breach is that criminals will use your information to apply for credit cards, loans, or bank accounts in identity theft or fraud schemes - so a loan company having customer information compromised would make it almost too easy for cybercriminals.

Included in the leak were passports, ID cards, driving licenses, utility bills, bank statements, and loan agreement letters, among other things - here’s what we know so far.

Ongoing investigation

Researchers discovered the leak on November 28, 2024, and the bucket wasn’t closed until January 16, 2025, meaning criminals had over a month to find and access the data - although there’s no evidence to suggest any did - only an internal forensic audit would determine this.

Know Your Customer (KYC) documents are used by financial institutions to ensure they comply with regulations and laws with regards to proof of identity, address, and income. Unfortunately though, this is all a cybercriminal would need to take out a loan in a victim’s name, or to craft particularly compelling social engineering attacks.

“For instance, attackers could use leaked loan agreement details or bank information to request urgent payments or account verification,” Cybernews researchers said.

“In some cases, these personal details can be aggregated and sold on the dark web, further escalating the danger and complicating efforts for victims to protect their privacy and secure their identities,” the team added.

Data breaches are all too common, and fintech firms aren’t immune. Earlier in 2025, Mexican FinTech firm Miio suffered a similar data breach which exposed millions of files of sensitive data - although significantly fewer than the Vivifi leak.

Serious risk for customers

This data breach is, unfortunately, the perfect opportunity for an attacker. The KYC documents are exactly what cybercriminals need to facilitate identity theft and fraud. With the identifying documents and personally identifiable information (PII), attackers can take out a loan, credit card, or create new bank accounts in your name.

To stay safe from this, the key is staying alert and monitoring your accounts. There are identity theft protection plans for individuals and for families, which essentially do the monitoring for you, and often provide $1 million or more in insurance plans, as well as dark web monitoring and anti-malware software - which can be very tricky to set up on your own.

If you want to do the monitoring yourself, perhaps you haven’t been directly impacted by a breach but want to stay protected - then here are the things to keep an eye out for.

First, is your bank statements, accounts, and transactions - if you see any suspicious activity, alert your bank immediately and freeze or pause your card if you can.

Next, create a strong and secure password for each individual account, or at least for the ones which hold financial, health, or sensitive information - and if a service you use is involved in a breach or cyberattack, make sure you change the password straight away.

Although it’s a pain, enabling multi-factor authentication or MFA is a great added layer of protection against intruders, so for those accounts with sensitive information - it's vital.

When PII is leaked, there’s always an added danger of social engineering attacks like phishing, which will use the data from the breach to determine which services you use regularly, what your interests are, or even your friends and family.

From there, attackers will send an email impersonating one of the above, and will trick you into clicking a malicious link, scanning a QR code, or handing over your details to them.

Be on the lookout for any unexpected communications, and look closely at the sender of emails - if you’re not sure, then don’t press any links, and search up what the legitimate email address would be - or contact the company directly through their website.

Remember, your bank will not ask you for your account details over the phone or through email - and they won’t ask you to transfer your funds to a different account.

You might also like



via Hosting & Support
Labels:

Comments

Post a Comment

Web Hosting
Remote IT Support
Sites & Socials

Popular posts from this blog

Last orders! Breville’s Birthday Sale ends in 24 hours – save an extra 10% on already-discounted espresso machines with our exclusive code

Web Hosting & Remote IT Support It’s been a busy month for coffee machine maestro, Breville. Not only did it celebrate International Coffee Day at the start of the month, but this October is also the company’s birthday month. And to mark the occasion, you can save up to AU$550 on a range of top-performing espresso machines . And that’s not all, as you can save a further 10% on discounted models with our exclusive Breville coupon code . Alternatively, you can use our exclusive promo code sitewide on the complete range of Breville appliances. You’ll need to hurry though, as the Breville Birthday Sale comes to a close at 11:30pm AEDT 21 October. Breville is, of course, responsible for some of the best coffee machines in Australia , and as a result, it can make choosing the ideal model for your household a little bit trickier. To help guide you to cafe-quality coffee at home, I’ve picked out so...
Post a Comment
Read more

Mova V70 Ultra Complete review: a full-featured robovac let down by subpar performance

Web Hosting & Remote IT Support Mova V70 Ultra Complete: Two-minute review If you've never heard of Mova as a brand, you're not alone as it was initially only available in select European and South-East Asian countries. The brand, which is owned by Dreame Technology, is now expanding and is supposed to be value-focused side of the company — although you'd be hard pressed to believe that when its latest flagship robot vacuum costs upwards $1,000 / £1,000 / AU$3,000. However, the Mova V70 Ultra Complete brings everything you expect from such an expensive robovac, including some industry-first features that are now being adopted by other brands. This includes suction that's a whopping 42,000Pa at its maximum, as well as the impressively long reach of the side brush and mopping arm (12cm and 17cm respectively). I even love the fact that it eliminates the need for dust bags by us...
Post a Comment
Read more

UK small businesses are spending big on Anthropic — but OpenAI isn't far behind as expenditure on AI tools hits new high

Web Hosting & Remote IT Support An estimated 1 out of every 8 UK small and medium businesses are paying for AI tools Over 28% of SMEs are using two or more AI platforms Publishing is the main UK sector adopting AI British SMEs are moving toward AI solutions, with adoption increasing from 1.1% in 2023 to 12.8% in 2026, new research has claimed. The study , by small business credit card providers Capital on Tap, also shows that while smaller companies may have more modest budgets, they’re still happy to spread their bets when it comes to choosing an AI solution. Over 28% of SMEs are using multiple AI platforms – with Anthropic’s Claude just edging out OpenAI’s ChatGPT, with the average quarterly spend growing to a quarterly average of £75.60 per SME. SMEs explore AI Anthropic is the most popular AI provider among British SMEs according to the research, with those businesses devoting 54.1% of ...
Post a Comment
Read more