The data of 300,000 Belfius customers can be purchased online. The number of affected could be lower due to duplicate data.
Data News discovered the details of the data breach. A hacker on a data breach forum offers bank data for sale, on the one hand from a Spanish bank and on the other hand from a Belgian bank. To prove the validity of the data, the hacker already released some test data. By checking that data, Data News was able to find out that the information is correct and that it originates from Belfius.
No financial details, but personal ones
The data would mainly be personal details of customers. Just think of names, addresses, telephone numbers, dates of birth and so on. Account numbers would also be included in the dataset, but no other financial data such as transactions or account balances. However, it remains sensitive information, which can lead to phishing or other forms of fraud. There may be less than 300,000 customers affected by the leak, because there are duplicate data in the dataset.
According to the hacker, the data was collected through call centers over the past year. It is therefore not certain where the data comes from exactly. It could be an internal or external Belfius call center or another source that has contacted Belfius customers.
Response from Belfius
Belfius itself has already responded by way of a concise press release. The bank would not be aware of a data breach, but says that the situation is being investigated “thoroughly and in detail”. However, there would be no IT security problems going on. In any case, all customers are advised to be “extremely vigilant” for any phishing attempts.