Info of Qatar National Bank customers, Al Jazeera staff, others, leaked online
A ZIP file containing information supposedly stolen in a hack of the Qatar National Bank has been published on whistleblower site Cryptome on Tuesday.
The contents of the Qatar data dump
The data dump has over 1.4 GB and contains nine main folders named “Al Jazeera”, “Al-Qardawi”, “Al-Thani”, “Banks, corporations”, “Defence and etc”, “Gov”, “Mukhabarat”, “Police, Security” and “Spy, Intelligence”.
It appears that the folders contain names, phone numbers, bank accounts and passwords, payment card data, PINs and other sensitive information of customers of the Qatar National Bank, sorted into the folders.
“The Al Jazeera folder contains 29 separate files on staff members [of the Qatar-based media network], while a spreadsheet includes the personal details of more than 1,200 people and organizations,” Doha News reports.
A number of former and current Al Jazeera journalists confirmed that their personal and financial details can be found in the leak, some of it accurate and some outdated. One of them also noted that he was never a QNB customer.
Apart from being worried about their accounts being accessed and emptied, some of them are not happy at being labeled as spies by the leaker, and the consequences of this affecting their work and travel options.
Some people’s leaked details also include links to their social media accounts, photographs, and social media accounts of their family members.
The leak also includes information about supposed members of UK’s MI6 and of Quatar’s Mukhabarat intelligence agencies, of intelligence agencies from France and Poland, of employees at the Qatar’s Ministry of Defense, army, as well as that of the Qatari royal family.
According to a number of independent sources who reviewed the leaked data, it appears to be genuine. Information expert Nitin Bhatnagar told BankInfoSecurity that the data dump also contains banking documents and administrator-level account access details.
Who did it?
The bank has released a statement saying that the leak had no financial impact on their clients or the bank, and that they are investigating the matter “in coordination with all concerned parties.”
Given the variety of the information included in the data dump, it’s likely that most of it was exfiltrated from the QNB, and the compiler(s) later added the rest in order to create more extensive profiles on certain individuals.
It is unknown who leaked the data.
“Unfortunately, it is not a matter of if but when sensitive or regulated corporate files will be publicly exposed. The interdependencies between banks, industry, government agencies and private citizens make it imperative to consider the grave consequences of data leakage, inadvertently or subversively, especially as confidential files are often shared between different entities,” says Gord Boyce, CEO of FinalCode.
“Financial services firms, like in other regulated industries, need to expand their data defense portfolios beyond that of thwarting hackers and monitoring for insider threats to securing files that may be exposed due to inadvertent emails, lost portable storage devices or unauthorized sharing. The best approach to prevent file data leakage is through the use of strong encryption and usage control.”