The National Credit Information Center (CIC), managed by Vietnam’s State Bank, suffered a severe cyberattack executed by the Scattered Spider hacking group and its affiliate ShinyHunters. The attackers exploited a vulnerability in end-of-life software to infiltrate the system, stealing approximately 160 million records containing highly sensitive personal and financial data. The compromised information includes names, addresses, credit card histories, government IDs, income statements, and debt records of Vietnamese citizens and businesses. The stolen data was offered for sale on a cybercriminal forum, with samples publicly shared to validate its authenticity. While no ransom was demanded, the breach poses critical risks to financial security, identity theft, and fraud across Vietnam’s banking sector. The Cyber Emergency Response Team (VNCERT) is investigating the incident in collaboration with state-owned telecom Viettel and other agencies, though the full extent of the damage remains unclear. Authorities have warned citizens against downloading or sharing the leaked data, threatening legal action against violators. The attack underscores vulnerabilities in government-managed financial infrastructure and raises concerns about the long-term reputational and economic impact on Vietnam’s credit system, given the scale and sensitivity of the exposed data.