Information security recommendations related to the incident at the CIC Credit Information Center

On September 11, 2025, the Vietnam Cyberspace Emergency Response Center (VNCERT) announced that it had recorded a cyber security incident with signs of personal data leakage at the National Credit Information Center (CIC). VNCERT and the National Cyber Security Center under the Department of Cyber Security and High-Tech Crime Prevention and Control coordinated with relevant units to investigate, verify, collect data and evidence for handling in accordance with the law.

Initial results show that the amount of data illegally collected at CIC does not include: Deposit accounts, deposit balances, savings books, payment accounts, credit card numbers, security codes (CVV/CVC), and customer payment transaction history. The information technology systems of credit institutions operate independently. Therefore, the service provision activities of credit institutions are carried out continuously, safely and stably.

The State Bank has also requested banks, payment intermediaries and CIC to urgently review and update security systems, strengthen supervision, apply multi-layer authentication, encryption, back up important data and proactively develop timely response plans to cyber security risks.

OnSHB's side, the Bank complies with the provisions of Circular No. 15/2023/TT-NHNN dated December 5, 2023 of the State Bank of Vietnam (SBV) regulating credit information activities of the SBV and Decision No. 573/QD-NHNN dated March 29, 2024 of the Governor of SBV on Promulgating the Credit Information Indicator System.

SHB affirms that it does NOT report to CIC information about electronic banking system login data (including: username, password, personal biometric information...); Information about data related to debit cards and credit cards (including: 16-digit series printed on the front of the card, CVV/CCC code printed on the back of the card...). All SHB system data is encrypted according to Vietnamese law and strictly complies with international standards on security and financial safety of customer information. Customers do not need to take measures such as: locking cards, locking accounts, changing CVC/CVV codes...

To proactively prevent risks, SHB respectfully sends you the following safety recommendations that need to be implemented immediately:

1. Be wary of fake messages/calls/emails asking to “ Update CIC information/check bad debt/receive account support… ”. Absolutely do not provide information or follow instructions related to personal data.

2. Do not provide OTP code, PIN, password or card information to anyone, even if they claim to be a bank employee, CIC, State Bank or competent authority. SHB absolutely never asks customers to provide OTP/PIN via phone, social network or strange link.

3. Only log in via SHB's official channels (SHB SAHA digital banking application, verified SHB website and Fanpage). Do not access links/QRs of unknown origin.

4. Update the latest version of the SHB SAHA app from Apple Store/Google Play. Never install apps in “.apk” format or from unauthenticated websites. Always enable biometric/multi-factor authentication for added security.

5. Set appropriate transaction limits for international credit and debit cards on the SHB SAHA digital banking application. At the same time, activate the security question feature on SAHA to enhance the safety of all transfer transactions.

6. Monitor account fluctuations regularly. If you detect any unusual signs, temporarily disconnect from the Internet, lock the transaction channel immediately and contact SHB via hotline *6688 (24/7) or the nearest transaction point for support.

7. Device security: Use reliable security software, do not log into your bank account via public wifi, limit sharing personal information (ID card/CCCD, phone number, email...) on public platforms.

In case of suspicion or detection of signs of fraud, you must immediately contact the 24/7 Customer Support Center (*6688), the nearest SHB transaction points or the police for timely handling.

SHB always puts the safety of customers' data and finances as an absolute priority, while strengthening system monitoring and closely coordinating with the authorities to protect the legitimate rights of customers. SHB will also continue to listen and closely monitor the developments of the incident from related units and promptly provide further specific instructions to all customers.

We sincerely thank you for always accompanying SHB and proactively raising vigilance to protect information security during this period.

Saigon - Hanoi Commercial Joint Stock Bank (SHB )

Source: https://www.shb.com.vn/khuyen-cao-an-toan-thong-tin-lien-quan-den-su-co-tai-trung-tam-thong-tin-tin-dung-cic/