Threat actor claims sale of BanCoppel customer database
A threat actor claims on an underground forum to be selling a BanCoppel customer database, with names, addresses, CURP, tax identifiers, phone numbers and credit details. The sale would run through an escrow service, no record count was given, and the bank has not confirmed an incident. The claim is unverified; customers should treat unexpected contact about accounts or credit with caution and use only official channels.
What happened
A threat actor on an underground forum is advertising what they claim is a customer database stolen from BanCoppel, the Mexican bank linked to the Coppel retail group. The seller takes buyers through an escrow service. The bank has not confirmed an incident, according to DailyDarkWeb.
Why it matters
If real, names, addresses, CURP, tax identifiers, phone numbers and credit details enable identity fraud and bank-impersonation calls or SMS, as DailyDarkWeb assesses. No record count was given. Bank customers are the main targets.
What to do
Monitor BanCoppel official statements for confirmation or denial. Tell customers to treat unexpected contact about accounts or credit with caution and use only official bank channels. Track intelligence services for verification of the claim.
For the technical team
- Affected
- BanCoppel, banco mexicano vinculado ao grupo de varejo Coppel; base alegada de clientes com nomes completos, endereços, · BanCoppel, Mexican bank linked to the Coppel retail group; alleged customer database.
- Exploitation
- Unverified threat-actor claim of sale on an underground forum, reported by DailyDarkWeb. Sale through an escrow service, no record count given. The bank has not confirmed an incident that DailyDarkWeb is aware of.
- Fix
- No software to update
- More details
- Alleged data: full names, physical addresses, CURP and tax identifiers, phone numbers, credit limits and Coppel credit product details. DailyDarkWeb analyst note: national ID numbers combined with credit details and phone numbers are ideal for identity fraud and bank-impersonation calls or SMS. Unverified claim, not confirmation of a breach. How the data was obtained was not described.
Timeline
Incident opened.
Sources 1 source
- @DailyDarkWeb @DailyDarkWeb
