Qatar National Bank data breach: 88K accounts exposed
Severity: high · Patch status: no-fix-needed · Since 2016-05-01
In July 2015, the Qatar National Bank suffered a data breach which exposed 15k documents totalling 1.4GB and detailing more than 100k accounts with passwords and PINs. The incident was made public some 9 months later in April 2016 when the documents appeared publicly on a file sharing site. Analysis of the breached data suggests the attack began by exploiting a SQL injection flaw in the bank's website. Exposed data: bank account numbers, customer feedback, dates of birth, financial transactions, genders, geographic locations, government issued ids, ip addresses, marital statuses, names, passwords, phone numbers, physical addresses, pins, security questions and answers, spoken languages. The breach dates from Jul 1, 2015; Have I Been Pwned loaded it on May 1, 2016.
What to do
- If you had a Qatar National Bank account, change its password and the password of any other account that reused it.
- Turn on multi-factor authentication wherever it is offered.
- Check whether your addresses are in this breach at https://haveibeenpwned.com.
- Expect targeted phishing that quotes the leaked details; verify any unexpected contact out of band.
Sources
All live incidents on Threat Watch
