Two Canadian banks – Bank of Montreal and Simplii Financial – say hackers stole customers’ information, demanded $1 million worth of Ripple to return the data.
The bullish trend of the digital currencies is continuously attracting hackers and scammers to the crypto space.
A group of hackers has reportedly hijacked the personal data of thousands of customers from two Canadian banks. The fraudsters are demanding for a ransom $1 million in Ripple (XRP) before they will safely return the stolen information and would publish them online if the banks fail to comply with their demand.
The hackers stole sensitive information of over 90,000 customers after breaching the banks’ security systems during the weekend. The stolen information included names, account numbers, account balances, social security numbers, security questions and answers, and passwords.
The perpetrators were able to hack into the banks’ security systems by using an algorithm to generate account numbers which allowed them to pretend to be actual account holders who had forgotten their passwords. With that, they were able to reset the backup security questions and answers which gave them access to the accounts.
“They were giving too much permission to a half-authenticated account which enabled us to grab all these information,” they said via a Russian-based email while stating that the bank’s system “was not checking if a password was valid until the security question was input correctly.”
According to emails received from the thieves, the hackers will post the data online unless the banks pay them the sum of $1 million using the fourth largest cryptocurrency, Ripple (XRP).
“We warned BMO and Simplii that we would share their customers information if they don’t cooperate. These … profile will be leaked on fraud forum and fraud community as well as the 90,000 left if we don’t get the payment before May 28, 2018, 11:59 PM.”
The deadline to pay the $1 million ransom has now passed. However, it is unclear if the hackers have published the information on the Internet just as they had threatened.
When asked if they paid any ransom, one of the banks said, “Our practice is not to make payments to fraudsters. We are focused on protecting and helping our customers.”
