Vietnam Social Security Data Breach: 2 Million Records Leaked in 2024

In September 2024, a significant data breach involving Vietnam's Social Security Administration (Bảo Hiểm Xã Hội Việt Nam) was reported, exposing sensitive personal information of nearly 2 million individuals. The leaked data, including 12-digit ID numbers, was posted on a dark web forum by a user known as "GovRansomArtist," who is offering the dataset for $600.

Company Overview

The Vietnam Social Security (VSS) is a government agency responsible for administering social security programs in Vietnam, including health insurance, social insurance, and unemployment benefits. Established in 1995, the agency serves millions of Vietnamese citizens, ensuring their social and economic well-being. The VSS plays a crucial role in the country's welfare system, managing vast amounts of sensitive data, including personal identification numbers, health records, and financial information.

Breach Details

The breach was discovered on September 3, 2024, when a post on a dark web forum revealed the sale of 2 million records stolen from the VSS. The data includes social security numbers, 12-digit ID numbers, and possibly other personal details that could be exploited for identity theft and fraud.

The breach is particularly concerning given the sensitive nature of the data. Social security numbers and ID numbers are often used in various official capacities in Vietnam, including accessing government services, banking, and employment. The exposure of this data puts affected individuals at significant risk of identity theft, financial fraud, and other malicious activities.

Prior Breach Information

This is not the first time the Vietnam Social Security Administration has faced a data breach. In 2020, a smaller breach occurred, affecting around 200,000 records. Although less severe, the 2020 breach raised concerns about the agency's cybersecurity practices. At that time, the VSS pledged to enhance its security measures, but the recent 2024 breach suggests that these measures may have been insufficient.

The current breach is far more extensive and highlights ongoing vulnerabilities within the agency's cybersecurity infrastructure. It underscores the need for more robust security protocols, regular security audits, and a proactive approach to data protection.

Threat Actor Profile

The individual or group behind this breach, known as "GovRansomArtist," is relatively new to the cybercrime scene, having joined the dark web forum only in September 2024. Despite their recent appearance, they have quickly gained attention by leaking such a significant dataset. The motives behind the breach are likely financial, given the asking price of $600 for the stolen data. However, the sale of government-related data suggests a broader agenda, possibly aimed at undermining trust in public institutions or causing widespread disruption.