LAPSUS$ targeted Myanmar's AYA Bank, stole 120GB of banking data

AYA Bank, one of Myanmar’s largest private commercial banks, said it suffered a significant data security incident that involved the LAPSUS$ hacker group infiltrating its internal network and stealing confidential data.

Last week, the LAPSUS$ hacker group claimed that it breached AYA Bank’s internal network and added the bank as a victim on its data leak site. The group said it had stolen more than 120 GB of sensitive data and threatened to publish the dataset on July 8 unless a ransom is paid.

Officially known as Ayeyarwady Bank Public Company Limited and headquartered in Yangon, AYA Bank offers personal and business banking solutions with a total asset value of approximately 9.5 trillion MMK, or £3.42 billion, and a paid up capital of 297 billion MMK, or £107.1 million. The bank runs 261 branches and 623 ATMs and has over 6,500 employees in Myanmar.

Following the hacking group’s post on the dark web, AYA Bank said in an announcement on social media that it suffered a significant cyber security incident where threat actors breached an application portal that exposed the sensitive personal information of its customers.

“The affected portal was not connected to our Core Banking System, AYA Pay, card systems, or any other essential banking infrastructure,” the bank said, adding that customers could continue using internet and mobile banking services without any interruption.

The bank further explained that the incident involved a limited amount of information stored in an outdated application portal, which was separate from its Core Banking System, AYA Pay, Card System, and other critical banking platforms. As a result, AYA Pay, AYA Internet Banking, and Mobile Banking services remain fully operational, secure, and unaffected by the incident.

The bank said it has strengthened its cybersecurity safeguards following the incident and issued an apology to its customers, while maintaining that its core financial systems and sensitive banking data remain protected. As of June 29, AYA Bank has not disclosed the alleged volume of data reportedly obtained by the hackers or commented on the ransom amount demanded by hackers.