The National Credit Information Center (CIC) of Vietnam suffered a cyberattack by ShinyHunters, a prolific threat actor known for large-scale data breaches. The attackers exploited an unpatched 'n-day' vulnerability in end-of-life software used by CIC, gaining unauthorized access to steal personal data of Vietnamese citizens. While no ransom demands were made, the stolen data—including contact details, payment identifiers, and references to financial institutions—was listed for sale on a dark web hacking forum, with samples provided as proof.The breach exposed a centralized repository of credit data, risking identity theft, financial fraud, and systemic instability across Vietnam’s financial sector. Authorities, including VNCERT, Viettel, VNPT, and NCS, launched investigations, while the State Bank of Vietnam (SBV) reassured customers that bank account numbers, balances, and transaction histories were not compromised. However, the leaked personally identifiable information (PII) remains a severe risk for fraud. JPMorgan noted potential increased cybersecurity costs for banks and risks to deposit flows, though no immediate financial system collapse was reported.