Top digital loan firm security slip-up puts data of 36 million users at risk
- Indian loan company Vivifi has reportedly suffered a data breach
- 36 million files were left exposed
- These consisted primarily of personally identifiable information (PII)
A leading digital lending app has apparently exposed sensitive customer data after a misconfigured Amazon AWS S3 was bucket left unsecured without authentication.
Cybernews researchers discovered loan provider Vivifi left 36 million files of Know Your Customer (KYC) documents open online. The primary risk after a data breach is that criminals will use your information to apply for credit cards, loans, or bank accounts in identity theft or fraud schemes – so a loan company having customer information compromised would make it almost too easy for cybercriminals.
Included in the leak were passports, ID cards, driving licenses, utility bills, bank statements, and loan agreement letters, among other things – here’s what we know so far.
Ongoing investigation
Researchers discovered the leak on November 28, 2024, and the bucket wasn’t closed until January 16, 2025, meaning criminals had over a month to find and access the data – although there’s no evidence to suggest any did – only an internal forensic audit would determine this.
Know Your Customer (KYC) documents are used by financial institutions to ensure they comply with regulations and laws with regards to proof of identity, address, and income. Unfortunately though, this is all a cybercriminal would need to take out a loan in a victim’s name, or to craft particularly compelling social engineering attacks.
“For instance, attackers could use leaked loan agreement details or bank information to request urgent payments or account verification,” Cybernews researchers said.
“In some cases, these personal details can be aggregated and sold on the dark web, further escalating the danger and complicating efforts for victims to protect their privacy and secure their identities,” the team added.
Data breaches are all too common, and fintech firms aren’t immune. Earlier in 2025, Mexican FinTech firm Miio suffered a similar data breach which exposed millions of files of sensitive data – although significantly fewer than the Vivifi leak.
Serious risk for customers
This data breach is, unfortunately, the perfect opportunity for an attacker. The KYC documents are exactly what cybercriminals need to facilitate identity theft and fraud. With the identifying documents and personally identifiable information (PII), attackers can take out a loan, credit card, or create new bank accounts in your name.
To stay safe from this, the key is staying alert and monitoring your accounts. There are identity theft protection plans for individuals and for families, which essentially do the monitoring for you, and often provide $1 million or more in insurance plans, as well as dark web monitoring and anti-malware software – which can be very tricky to set up on your own.
If you want to do the monitoring yourself, perhaps you haven’t been directly impacted by a breach but want to stay protected – then here are the things to keep an eye out for.
First, is your bank statements, accounts, and transactions – if you see any suspicious activity, alert your bank immediately and freeze or pause your card if you can.
Next, create a strong and secure password for each individual account, or at least for the ones which hold financial, health, or sensitive information – and if a service you use is involved in a breach or cyberattack, make sure you change the password straight away.
Although it’s a pain, enabling multi-factor authentication or MFA is a great added layer of protection against intruders, so for those accounts with sensitive information – it’s vital.
When PII is leaked, there’s always an added danger of social engineering attacks like phishing, which will use the data from the breach to determine which services you use regularly, what your interests are, or even your friends and family.
From there, attackers will send an email impersonating one of the above, and will trick you into clicking a malicious link, scanning a QR code, or handing over your details to them.
Be on the lookout for any unexpected communications, and look closely at the sender of emails – if you’re not sure, then don’t press any links, and search up what the legitimate email address would be – or contact the company directly through their website.
Remember, your bank will not ask you for your account details over the phone or through email – and they won’t ask you to transfer your funds to a different account.
You might also like
Indian loan company Vivifi has reportedly suffered a data breach 36 million files were left exposed These consisted primarily of personally identifiable information (PII) A leading digital lending app has apparently exposed sensitive customer data after a misconfigured Amazon AWS S3 was bucket left unsecured without authentication. Cybernews researchers discovered…
