Skip to main content

Top digital loan firm security slip-up puts data of 36 million users at risk

Web Hosting & Remote IT Support
  • Indian loan company Vivifi has reportedly suffered a data breach
  • 36 million files were left exposed
  • These consisted primarily of personally identifiable information (PII)

A leading digital lending app has apparently exposed sensitive customer data after a misconfigured Amazon AWS S3 was bucket left unsecured without authentication.

Cybernews researchers discovered loan provider Vivifi left 36 million files of Know Your Customer (KYC) documents open online. The primary risk after a data breach is that criminals will use your information to apply for credit cards, loans, or bank accounts in identity theft or fraud schemes - so a loan company having customer information compromised would make it almost too easy for cybercriminals.

Included in the leak were passports, ID cards, driving licenses, utility bills, bank statements, and loan agreement letters, among other things - here’s what we know so far.

Ongoing investigation

Researchers discovered the leak on November 28, 2024, and the bucket wasn’t closed until January 16, 2025, meaning criminals had over a month to find and access the data - although there’s no evidence to suggest any did - only an internal forensic audit would determine this.

Know Your Customer (KYC) documents are used by financial institutions to ensure they comply with regulations and laws with regards to proof of identity, address, and income. Unfortunately though, this is all a cybercriminal would need to take out a loan in a victim’s name, or to craft particularly compelling social engineering attacks.

“For instance, attackers could use leaked loan agreement details or bank information to request urgent payments or account verification,” Cybernews researchers said.

“In some cases, these personal details can be aggregated and sold on the dark web, further escalating the danger and complicating efforts for victims to protect their privacy and secure their identities,” the team added.

Data breaches are all too common, and fintech firms aren’t immune. Earlier in 2025, Mexican FinTech firm Miio suffered a similar data breach which exposed millions of files of sensitive data - although significantly fewer than the Vivifi leak.

Serious risk for customers

This data breach is, unfortunately, the perfect opportunity for an attacker. The KYC documents are exactly what cybercriminals need to facilitate identity theft and fraud. With the identifying documents and personally identifiable information (PII), attackers can take out a loan, credit card, or create new bank accounts in your name.

To stay safe from this, the key is staying alert and monitoring your accounts. There are identity theft protection plans for individuals and for families, which essentially do the monitoring for you, and often provide $1 million or more in insurance plans, as well as dark web monitoring and anti-malware software - which can be very tricky to set up on your own.

If you want to do the monitoring yourself, perhaps you haven’t been directly impacted by a breach but want to stay protected - then here are the things to keep an eye out for.

First, is your bank statements, accounts, and transactions - if you see any suspicious activity, alert your bank immediately and freeze or pause your card if you can.

Next, create a strong and secure password for each individual account, or at least for the ones which hold financial, health, or sensitive information - and if a service you use is involved in a breach or cyberattack, make sure you change the password straight away.

Although it’s a pain, enabling multi-factor authentication or MFA is a great added layer of protection against intruders, so for those accounts with sensitive information - it's vital.

When PII is leaked, there’s always an added danger of social engineering attacks like phishing, which will use the data from the breach to determine which services you use regularly, what your interests are, or even your friends and family.

From there, attackers will send an email impersonating one of the above, and will trick you into clicking a malicious link, scanning a QR code, or handing over your details to them.

Be on the lookout for any unexpected communications, and look closely at the sender of emails - if you’re not sure, then don’t press any links, and search up what the legitimate email address would be - or contact the company directly through their website.

Remember, your bank will not ask you for your account details over the phone or through email - and they won’t ask you to transfer your funds to a different account.

You might also like



via Hosting & Support
Labels:

Comments

Post a Comment

Web Hosting
Remote IT Support
Sites & Socials

Popular posts from this blog

The Samsung Galaxy Ring could go into production as soon as next month

Web Hosting & Remote IT Support With the dust beginning to settle from the huge Samsung Unpacked 2023 event, we can turn our attention towards what Samsung might have planned next: and a smart ring seems to be in the company's near future. As per a report from South Korean outlet The Elec (via SamMobile ), mass production on a Samsung Galaxy Ring could begin as early as August, with a decision imminent on the schedule for getting the wearable manufactured and out to consumers. A full launch is slated for some point during 2024 though, rather than 2023. The nature of the device means that it'll need to clear several regulatory hurdles before it can go on sale and start tracking various vital statistics. An early 2024 launch would put the Galaxy Ring on a similar schedule to the Samsung Galaxy S24 – and it would therefore make sense to launch both gadgets at the same time, perhaps in January or February if Samsung follows its 2023 routine. The story so far Rumors ar...
Post a Comment
Read more

The Apple Watch ban is lifted, on appeal – but the reprieve might only be temporary

Web Hosting & Remote IT Support The Apple Watch ban story has developed quickly over the last week and a bit, and there's now a new twist: the US Court of Appeals is putting a pause on the US sales and import ban while it reviews the case, which means the Apple Watch 9 and Apple Watch Ultra 2 can go back on sale for the time being. "We are thrilled to return the full Apple Watch lineup to customers in time for the new year," an Apple spokesperson told TechRadar. "We are pleased the US Court of Appeals for the Federal Circuit has stayed the exclusion order while it considers our request to stay the order pending our full appeal." The watches in question are now once again available from "select" Apple Stores, and will also be going on sale from the Apple website from 12pm PT / 3pm ET on Thursday, December 28 (that's 8pm in the UK, and early on December 29 in Australia). All Apple Stores should have stock by the weekend. As for how long t...
Post a Comment
Read more

These mobile games are just trying to steal your crypto hoard, FBI warns

Web Hosting & Remote IT Support The FBI has warned consumers about a newly-detected, fake "play-to-earn" mobile and online game that tricks victims into depositing cryptocurrency, only to later steal it.  In a public service announcement , the FBI said the elaborate scheme sees scammers first contact the potential victim and try to build a relationship with them.  After a little back-and-forth, the scammers would invite the victim to play an online or mobile game, in which players purportedly earn cryptocurrency rewards in exchange for some activity, “such as growing ‘crops’ on an animated farm” the FBI said.  Depositing cryptos But getting into the “game” isn’t free - the victims must first create a cryptocurrency wallet and deposit some money, which is where the real scam begins. The fraudsters would later also tell the victims that the more funds they deposit, the higher the gains will be. However, as soon as the victim stops depositing additional funds, the...
Post a Comment
Read more