Rex Mundi hackers try, fail to blackmail Swiss bank

The Banque Cantonale de Geneve has refused to pay the ransom demanded by a group of hackers that goes under the name of Rex Mundi, and they have made good on their word and have published the whole batch of customer emails they managed to steal from the bank’s website.

As confirmed by the bank on January 7, the attack was aimed at intercepting information on a website used as an interface and communication tool with customers and people interested in the bank’s services.

The stolen information included “certain information transmitted by internet users, but in no way critical and of no great use or even obsolete.” No critical data was compromised, they said, only limited non-financial information which does not endanger account security.

“The bank notes that this incident occurred outside the bank’s highly secure perimeters,” they stated, adding that all affected users have been notified of the incident. They have also been warned about potential phishing emails or calls that they might receive in the wake of this leak.

The Rex Mundi hackers, who have a well-documented track record of targeting businesses, stealing their information, and asking for money in order not to publish it, demanded 10,000 euros (around $12,000) for not releasing the stolen data.

The leaked batch apparently contains some 30,000 emails customers sent and received when making enquiries with the bank. The emails include some personal information about the customers (names, phone numbers, addresses, etc.).

If a comment on Rex Mundi’s Twitter account is to be believed, the data was stolen by taking advantage of a SQL injection vulnerability in the bank’s website.