- A hacker claims that they stole customer data from BNI and have live access to the bank’s mobile banking system.
- This claim remains unverified, and experts warned that such ads tend to inflate their capabilities.
- If true, the information may allow the hacker to conduct account takeover or other fraudulent schemes involving personal data of clients.
A threat actor on an underground forum claims to sell live access to Bank Negara Indonesia, or BNI. The seller also claims to hold a large customer database linked to the state-owned bank.
The claim includes alleged access to the mobile banking backend of BNI and a SOAP web service. However, no independent researcher has confirmed that the data or access is real.
What the Seller Claims
The threat actor says the offering includes a complete customer database. Reported data features CIF numbers, names, email IDs, and matching phone numbers.
A similar allegation involved a hacker claiming to sell 15 million records belonging to Brazilian individuals for $20,000, highlighting the continued appearance of large datasets on underground markets.
CIF means Customer Information File — banks use CIF to retain significant information about customers, including their identity and account details.
The seller also claims to offer unauthenticated access to BNI’s mobile banking backend. This means a person could allegedly reach the service without logging in.
The listing mentions hundreds of exposed web methods. These methods allegedly cover account details, card operations, beneficiary actions, and credential changes.
The actor describes the access as live production access. This means the seller claims it connects to BNI’s current banking systems, not an old data dump.
Why Experts Urge Caution
According to some experts in security, claims of available live banking access are hardly as simple as sellers state. For example, screenshots and step-by-step instructions are not enough proof of a functional system.
The phrase ‘complete customer database’ is also a common sales tactic on underground forums. Sellers use the term to entice clients and boost selling price. The claim remains unverified. It does not confirm that BNI’s production systems are currently compromised.
Researchers would need to test the alleged access, check the data samples, and confirm the source of the records. They would also need to prove that the information is fresh and belongs to real BNI customers. BNI has previously rejected similar breach claims. In May 2026, the bank said its investigation found no sign that attackers stole customer data.
Why the Claim Matters
In case the claim is true, attackers could potentially misuse the data of customers on an extensive basis. They might try phishing, fraudulent activities, and hijacking accounts of customers.
Furthermore, access to a part of a mobile banking service that has no authentication would also have grave consequences. It would allow an attacker to transmit commands directly to the bank service without an authenticated session.
Exposed SOAP web services can create another risk. SOAP is a protocol via which two software systems share structured messages over the Internet.
If attackers managed to get hold of confidential web services, they would take steps to see account information, alter passwords, and exploit card functions. As a result, it is quite possible that this would cause a situation where someone loses money or suffers identity theft.
Additionally, there is a risk of mass PII abuse. PII stands for personally identifiable information, meaning that it includes data useful for identifying individuals, such as their names, contacts plus other account details.
What BNI and Regulators Should Do
BNI should treat the claim as a high-priority security alert. The technical staff of the bank should conduct a thorough investigation of its mobile banking systems, including any SOAP web services and APIs used by clients.
The security team must determine whether any of its web methods allow access without proper user identification. Also, it is necessary that they implement the use of strong authentication protocols, strict access control, and validate data inputs.
The bank should also have log monitoring in place to detect anomalies. It should look for repeated API calls, strange IP addresses, and attempts to reach credential-change functions.
In addition, BNI should change its passwords in the event that it notices any problems or vulnerabilities. The bank must verify whether it can suffer an attack on some sensitive endpoints of its network from outside.
Furthermore, Indonesian regulators should supervise the case of BNI. They should verify whether the bank observes the guidelines set for the response to an incident of this kind.
What Customers Can Do
Customers ought to remain vigilant for any unusual communications that appear to be from the BNI. The bank says it does not seek the pin numbers, OTP codes, CVV codes, user name or password of customers.
Further, customers should not click links in unexpected emails or text messages. They should also never share their one-time passwords with anyone.
If a user suspects any signs of abnormal activity related to their bank account, they must change their banking password. Users must also activate transaction alerts and frequently check their statements.
If anyone sees any questionable charge, they need to immediately reach out to BNI. The bank says that they need to report any suspicion of fraud via official channels.
The latest allegations do not substantiate the claim of a breach at BNI. However, it does highlight the necessity for all banks to secure their customer databases, their mobile banking systems, and their backend APIs.
