Data Breach @ PNB

A vulnerability in the server of Punjab National Bank allegedly exposed the personal and financial information of its about 180 million customers for about seven months.

Researchers has claimed that the vulnerability provided access to the entire digital banking system of PNB with administrative control.The bank has confirmed about the glitch but denied any exposure of critical data due to the vulnerability.

This vulnerability was found in an exchange server which is interconnected without other exchanges and shares all access including access to all email addresses which results in access to all email addresses.

The vulnerability which we discovered was leading to the highest level of admin privilege in PNB’s exchange servers. If you gain access to Domain Controller through an exchange server then the doors very easily open to make any computer accessible in the network.

These computers even include those that are being used in their branches and other departments.PNB said the server in which the vulnerability was found had no sensitive or critical data.

The server wherein the vulnerability was reported, was being used as one of the multiple Exchange Hybrid servers used to route emails from On-prim to Office 365 Cloud. There is no sensitive/critical data in this server. The server is in a separate VLAN segment and customer data/applications are not affected due to this. Vulnerability assessments and penetration testing is done periodically by external Cert-in empanelled Information Security Auditors and the observations are complied with.Now this server has been shut down as a precautionary measure.

PNB Statement

According to CyberX9, the vulnerability was mitigated on November 19, and it reported the incident to Indian cyber security watchdog Cert-In and National Critical Information Infrastructure Protection Centre (NCIIPC).