PNB data breach: Bank didn't know details of 10,000 credit, debit card holders were on sale for months

The beleaguered Punjab National Bank (PNB) is going through a really tough phase, and its troubles don't seem to end anytime soon as the lender has been hit by a serious data breach, affecting thousands of its customers.

PNB, which is already under the government scanner due to a multi-crore rupee financial fraud by billionaire jeweller Nirav Modi, reported that the data breach has affected some 10,000 of its credit or debit card holders. According to Asia Times, a Hong Kong-based news publication, security experts believe that sensitive details were leaked on the internet, and had been made available for purchase through a website for at least three months.

The bank was not aware of the breach until it was informed on Wednesday by CloudSek Information Security, a Singapore-registered company that monitors data transactions, the report said.

"We have a crawler that is deployed in the dark/deep web. These are sites on the internet which are not indexed by Google or other major search engines. They are used to buy and sell sensitive data illegally," chief technical officer Rahul Sasi told the publication.

"Our crawler detects any such data and sends it to a Machine Learning software that we have created. If this detects anything that is suspicious, and of interest to our clients, we immediately take action."

The leaked data includes names, expiry dates, Personal Identification Numbers and Card Verification Values of the victims. There were mainly two sets of data that got released -- some with CVV numbers and some without.

The last date stamp on the data was January 29, suggesting that the leaked details were still in use for many customers, the report added.

According to Sasi, CloudSek tried to contact PNB after the data breach was detected, but the firm couldn't do it because it was not a customer at the bank. However, PNB was eventually informed through a government agency, and the bank's chief information security officer, TD Virwani, has reportedly confirmed that it was working with the authorities to further investigate the data leak.

It's still unknown whether the breach occurred due to an infected customer device or any third party was involved. However, an investigator told Asia Times that the bank's security was probably compromised since a large amount of data originated from a single source.