AYA Bank Confirms Cyberattack as LAPSUS$ Claims Massive Data Breach Myanmar’s AYA Bank, one of the country’s largest private financial institutions, has acknowledged a cyberattack on its digital infrastructure after the extortion group LAPSUS$ claimed to have stolen over 120GB of sensitive data. The breach was first announced by the hackers on June 23, with a threat to publish the compromised information on the dark web by July 8 unless a ransom is paid. In a June 25 statement posted on its official Facebook page, AYA Bank confirmed that an older application portal had been breached, exposing some customer data. However, the bank emphasized that the incident did not affect its Core Banking System, AYA Pay, or card services, assuring customers that internet and mobile banking operations remain unaffected. The bank also stated it had strengthened its cybersecurity measures in response. While AYA Bank did not disclose the exact volume of data compromised or the ransom demand, independent cybersecurity tracking platforms including Ransomware.live and RedPacket Security verified LAPSUS$’s claims on dark web leak sites. The group alleges the stolen dataset includes personally identifiable customer information, though the authenticity and origin of the data have not been independently confirmed. LAPSUS$ has a history of high-profile cyber-extortion, previously targeting major tech companies such as Microsoft, Nvidia, Samsung, and Uber. As of now, AYA Bank has not publicly addressed whether it will engage with the hackers’ demands.