Some 10,000 credit or debit card holders have been affected by a data breach reported by Punjab National Bank (PNB), which is already reeling under a multi-crore rupee financial fraud by two fugitive luxury jewellers.
According to an Asia Times report, security experts believe that the sensitive card details of customers were offered for sale through a website for at least three months.
The data available for sale includes names, expiry dates, Personal Identification Numbers and Card Verification Values.
The Hong Kong-based English language news reported that the bank not aware of the breach until it was tipped off on Wednesday night by CloudSek Information Security, a company registered in Singapore that also has its office in Bengaluru. The firm monitors data transactions.
"We have a crawler that is deployed in the dark/deep web. These are sites on the Internet which are not indexed by Google or other major search engines. They are used to buy and sell sensitive data illegally," chief technical officer Rahul Sasi was quoted as saying by the news site.
"Our crawler detects any such data and sends it to a Machine Learning software that we have created. If this detects anything that is suspicious, and of interest to our clients, we immediately take action."
He said CloudSek was unable to contact PNB after detecting the breach as it is not a customer at the bank but eventually passed the details through a government agency. PNB's Chief Information Security Officer T.D. Virwani has confirmed it was working with the government to contain the fallout from the release of the data. Asia Times knows the website’s name but is withholding this information at the request of investigators.
The disclosure will raise further questions about security levels at the bank, which is already under stress over a reported US$1.77 billion fraud involving fake letters of guarantee that were allegedly used by leading jeweller Nirav Modi to raise funds from banks. Two PNB employees allegedly colluded with Modi and his uncle in the scam.
According to an Asia Times report, security experts believe that the sensitive card details of customers were offered for sale through a website for at least three months.
The data available for sale includes names, expiry dates, Personal Identification Numbers and Card Verification Values.
The Hong Kong-based English language news reported that the bank not aware of the breach until it was tipped off on Wednesday night by CloudSek Information Security, a company registered in Singapore that also has its office in Bengaluru. The firm monitors data transactions.
"We have a crawler that is deployed in the dark/deep web. These are sites on the Internet which are not indexed by Google or other major search engines. They are used to buy and sell sensitive data illegally," chief technical officer Rahul Sasi was quoted as saying by the news site.
"Our crawler detects any such data and sends it to a Machine Learning software that we have created. If this detects anything that is suspicious, and of interest to our clients, we immediately take action."
He said CloudSek was unable to contact PNB after detecting the breach as it is not a customer at the bank but eventually passed the details through a government agency. PNB's Chief Information Security Officer T.D. Virwani has confirmed it was working with the government to contain the fallout from the release of the data. Asia Times knows the website’s name but is withholding this information at the request of investigators.
The disclosure will raise further questions about security levels at the bank, which is already under stress over a reported US$1.77 billion fraud involving fake letters of guarantee that were allegedly used by leading jeweller Nirav Modi to raise funds from banks. Two PNB employees allegedly colluded with Modi and his uncle in the scam.