Bucharest Stock Exchange breach: hackers got investors' IBANs and ID card numbers

Last name, first name, address, personal identification number, ID card series and number, email address, phone number and IBAN. That is what hackers were able to view in an application run by Depozitarul Central, the body that keeps the register of shares listed on the Bucharest Stock Exchange.

The depository, which belongs to the Bucharest Stock Exchange (BVB) group, made the incident public on October 16. The target: “Servicii Online pentru Investitori,” the portal where Romanian retail investors create an account to access their information online. According to its statement, picked up by the Romanian press, the application is temporarily unavailable and the attack allowed unauthorized access to the data provided at registration. The organization did not say how many people are affected.

Are investors' shares at risk?

No, according to the depository. It says its critical functions, transaction settlement and register keeping, are running normally and that the securities held have not been modified. For its part, BVB says its trading systems were not affected.

The organization chooses its words carefully: the data was reportedly “viewed,” but not modified or altered. Yet the Ziarul Financiar headline speaks of data being “extracted.” At this stage, nothing public says how much may have been copied. No claim of responsibility has been reported.

The depository says it detected the intrusion the same day. According to the Romanian site Goldring, it dates back to October 8, eight days before the announcement. We did not find that date in the excerpts of the statement. According to LeMagIT, Romania's national cybersecurity authority (DNSC) has been notified. According to the depository, the portal's passwords were not compromised.

Why scammers want this data

An IBAN alone does not let anyone empty an account. But here it comes with a full identity, the national number assigned to every Romanian, a phone number and one certainty: the person holds securities. That is enough to build a credible scam, for example a fake bank or broker adviser who calls and cites accurate information. This type of fraud requires no further hacking.

For companies, the lesson goes beyond Romania. The targeted portal was only an ancillary service, alongside the core business. Yet it kept a complete identity file for every registered user.

What to do if you are affected

The Romanian press is relaying several tips, valid for any breach of this kind:

• use a different password for each financial service and enable two-factor authentication;
• check any message supposedly from a bank or broker through its official channels;
• never share a verification code, even with someone who knows your IBAN and your address;
• if a caller mentions a loan or asks you to move money, hang up and call the bank back on its usual number;
• monitor your accounts and report fraud attempts to the DNSC (number 1911 in Romania).

Two questions remain open: how many investors were registered on the portal, and why did the public announcement take more than a week if the intrusion really dates from October 8?