InterBank 2024 Data Breach
Financial institution · Banking and financial services · Retail and commercial banking · Peru
Interbank Peru Retail Bank Breach (2024): 3.3 Million Customer Records Including SSN & Home Address Exposed
Peruvian bank offering retail and commercial financial services.
Confirmed · ObscureIQ Intelligence
Breach Risk Index i
60/100
Lower riskHigher risk
Moderate: notable exposure with meaningful misuse potential.
Data Sensitivity i
ElevatedExposed data raises the risk of fraud, targeting, and impersonation. Proactive steps are warranted.
3.3MRecords
2024Year
The Breach Risk Index (BRI) is a proprietary 0–100 score rating how dangerous a breach is right now, based on how recently the data has been circulating on the dark web and how valuable it is to attackers.
Crucial data exposed
SSNSocial Security Number
AddressPhysical address
Breach Summary
Interbank, a leading financial institution in Peru, confirmed a major data breach on October 30, 2024 after a threat actor using the alias 'kzoldyck' published stolen data on dark-web forums following a failed two-week extortion negotiation. The bank stated that customer data had been exposed by an unauthorized third party and that it had deployed additional security measures, while emphasizing that customer deposits and financial products remained secure. Customers reported intermittent outages of mobile and online platforms during the disclosure period.\n\nThe dataset published by the threat actor reportedly totaled around 3.7 terabytes and covered information on more than three million customers, with approximately 3.3 million records subsequently indexed in public breach-tracking services. Compromised fields included names, email addresses, phone numbers, home addresses, and Peruvian national identification numbers (DNI), with broader claims by the threat actor of also possessing dates of birth, IP addresses, financial transaction histories, credit card numbers with CVVs and expiration dates, plaintext usernames and passwords, and internal system credentials including API and Azure access.\n\nFor affected individuals, the practical risk is unusually severe and immediate. The combination of name, DNI, date of birth, and home address creates a strong base for identity-verification bypass at other Peruvian financial institutions and government services. Card data, where current, supports direct payment fraud; the threat actor's claim of plaintext credentials raises the prospect of direct account-takeover attempts limited only by Peru-IP and biometric controls Interbank has in place. Affected customers should change their Interbank credentials and any reused passwords, monitor financial transactions closely, and treat any unsolicited contact referencing their account or recent banking activity with extreme caution.
Full threat analysis, exploitation vectors, and principal guidance below.
11 additional sections · verified field analysis · defensive doctrine
Querying breach corpus…
Cross-referencing exposed field types…
Resolving threat-actor attribution…
Compiling principal risk advisory…
3.3M records analyzed
About InterBank
Interbank, formally known as Banco Internacional del Perú, is one of the leading financial institutions in Peru. Founded in 1897, it ranks as the country's fourth-largest bank by various measures and operates a national network of branches and ATMs serving more than two million customers. The bank offers retail, commercial, and digital banking services, with customer relationships built around current accounts, loans, credit cards, and digital banking platforms. In 2023 it reported more than $1.5 billion in revenue. Interbank's customer base is concentrated in Peru, with the bank handling identity, transaction, credit, and authentication records typical of a large national retail-banking institution.
Why They Hold Your Data
Retail and commercial banks collect highly sensitive identity, account, transaction, loan, device, and authentication data across banking and customer-service operations.
Recent Developments
Interbank has continued to operate following the October 2024 incident and has worked to restore customer confidence in its mobile and online platforms after a series of intermittent outages during the early days of the breach. The Cybercrime Prosecutor's Office of Lima brought criminal charges against the alleged hacker and demanded a cybersecurity report from Interbank covering the vulnerabilities that allowed the breach. Peruvian banking regulators announced that they were monitoring the incident for potential legal violations. The 2024 dataset has continued to circulate on dark-web forums in the months since the original disclosure, with the threat actor publicly stating Interbank refused to pay ransom.
Data Points Exposed
5 verified field types
Email Address
Full Name
Phone Number
Physical address High
Social Security Number Critical
Breach Impact
The 2024 incident produced meaningful institutional impact for Interbank. The bank faced an enforced criminal investigation by Peru's cybercrime prosecutors, parallel scrutiny from banking regulators, and a wave of media coverage in Peru that cast the bank as the highest-profile financial-sector breach victim in the country's recent history. Operationally, Interbank's mobile and online platforms experienced extended outages around the disclosure, and the bank had to rebuild authentication controls. The reputational cost has been concentrated in domestic Peruvian markets where the bank's brand is most central. The threat actor's public statements about the failed extortion negotiation contributed to public criticism of the bank's incident handling.
Exploitation & Downstream Threats
• Identity theft and synthetic identity construction using government-issued IDs | • SIM swap attacks where phone numbers are present | • Targeted phishing campaigns using exposed email addresses | • Doxxing risk from physical address exposure
Principal Risk Advisory
What this means for a principal
A financial-institution breach: account, wealth or payment data supports direct fraud and highly credible financial-impersonation scams. For a high-profile principal this is targeting-grade, not merely identity-theft-grade: the combination lets an adversary locate, impersonate, or pressure the principal with little additional work.
What You Should Do
- Freeze credit at all three bureaus and monitor for new-account and tax-refund fraud.
- Treat the home address as exposed: review mail and package handling and physical-security routines, and brief household staff to verify unusual requests.
- Guard against SIM-swap and vishing: add a carrier port-out PIN and verify any 'support' calls independently.
- Do not use unofficial 'am I affected' lookups; several are themselves harvesting operations.
How ObscureIQ Can Help
- Corpus confirmation: determine whether and where the principal (plus household and staff) appear in this dataset and which specific fields are exposed for them.
- Exposure mapping and footprint neutralization: cross-reference against broker-available data and suppress still-removable elements, prioritizing address and phone, since this record re-seeds broker networks.
- ThreatWatch tuned to this incident's identifiers and misuse pattern (impersonation and targeting patterns, not generic credential monitoring).
K
Threat Actor: kzoldyckConfidence: Low
Motivation: Unknown
A low-confidence alias with insufficient reliable public sourcing for a standalone threat actor profile. Treat as an alias requiring primary-source validation.
Protect Yourself
Check If You're Affected
Enter your email to check whether your data appears in this breach. We’ll send a 6-digit code to confirm it’s your address.
Get Free Breach Alerts
Be the first to know when new breaches are disclosed. Free forever — confirm your email with a 6-digit code.
High-Risk? Get an Exposure Audit
Executives, public figures, and high-visibility operators can receive tailored exposure intelligence and hardening guidance.
Request Consultation