Interbank, a leading financial institution in Peru, confirmed a major data breach on October 30, 2024 after a threat actor using the alias 'kzoldyck' published stolen data on dark-web forums following a failed two-week extortion negotiation. The bank stated that customer data had been exposed by an unauthorized third party and that it had deployed additional security measures, while emphasizing that customer deposits and financial products remained secure. Customers reported intermittent outages of mobile and online platforms during the disclosure period.\n\nThe dataset published by the threat actor reportedly totaled around 3.7 terabytes and covered information on more than three million customers, with approximately 3.3 million records subsequently indexed in public breach-tracking services. Compromised fields included names, email addresses, phone numbers, home addresses, and Peruvian national identification numbers (DNI), with broader claims by the threat actor of also possessing dates of birth, IP addresses, financial transaction histories, credit card numbers with CVVs and expiration dates, plaintext usernames and passwords, and internal system credentials including API and Azure access.\n\nFor affected individuals, the practical risk is unusually severe and immediate. The combination of name, DNI, date of birth, and home address creates a strong base for identity-verification bypass at other Peruvian financial institutions and government services. Card data, where current, supports direct payment fraud; the threat actor's claim of plaintext credentials raises the prospect of direct account-takeover attempts limited only by Peru-IP and biometric controls Interbank has in place. Affected customers should change their Interbank credentials and any reused passwords, monitor financial transactions closely, and treat any unsolicited contact referencing their account or recent banking activity with extreme caution.

Retail and commercial banks collect highly sensitive identity, account, transaction, loan, device, and authentication data across banking and customer-service operations.

Interbank has continued to operate following the October 2024 incident and has worked to restore customer confidence in its mobile and online platforms after a series of intermittent outages during the early days of the breach. The Cybercrime Prosecutor's Office of Lima brought criminal charges against the alleged hacker and demanded a cybersecurity report from Interbank covering the vulnerabilities that allowed the breach. Peruvian banking regulators announced that they were monitoring the incident for potential legal violations. The 2024 dataset has continued to circulate on dark-web forums in the months since the original disclosure, with the threat actor publicly stating Interbank refused to pay ransom.