FB pixel

User IDs and passport data leaks for 230K crypto users in Iran

User IDs and passport data leaks for 230K crypto users in Iran

A data leak from Iranian crypto exchange bit24.cash has exposed personal data from nearly 230,000 Iranian citizens, according to Cybernews.

Iran has taken up cryptocurrency significantly due to limited access to foreign markets. In 2023, Iranian crypto exchanges saw almost $3 billion in transactions.

Bit24.cash supports over 300 coins and tokens. Users complete a KYC process where they confirm their identity by uploading identity documents.

Cybernews researchers found a misconfigured MinIO that granted access to S3 buckets containing users’ KYC data. MinIO is an S3 compatible object storage system for large scale machine learning and data workloads.

The misconfiguration exposed users’ passports, ID documents, and credit cards, as well as written consent to regulations. The leak has since now been secured, according to the report.

“This breach poses a severe threat, as threat actors could potentially exploit the exposed data for identity theft, fraudulent transactions, and phishing attacks,” said the Cybernews researchers. “With access to such comprehensive personal and financial data, malicious actors could impersonate individuals, gain unauthorized access to accounts, execute fraudulent transactions, and potentially cause substantial financial and personal harm to the affected users.”

Hossein Amini, a security engineer at bit24.cash, officially responded to the claims on behalf of the company via email to Cybernews. The company says the claims are “inaccurate and misleading,” alleging it found no evidence of a data breach or unauthorized access to user information.

“The reference to a misconfigured MinIO instance granting access to S3 buckets containing KYC data is wholly untrue and does not align with our system architecture or security protocols,” said Amini. “We can confirm that our MinIO setup and cloud storage containers remain secure, and there has been no unauthorized access to any sensitive user data.”

An Ondato report delved into the relationship between ID documents and cryptocurrency fraud last year.

Article Topics

 |   |   |   | 

Latest Biometrics News


UK school reprimanded by ICO for using facial recognition without DPIA

A school in Chelmsford, Essex, has been reprimanded by the Information Commissioner’s Office (ICO) for the unlawful implementation of facial…


Tech5 introduces flexible biometric template protection for its ABIS

Tech5 has developed biometric template protection technology that it says meets the criteria set out in the ISO/IEC 30136 standard….


Maza streamlines KYC with Regula biometric and document verification

Regula has integrated its document and biometric verification system into Maza Financial, a fintech company based in the United States,…


More ballparks to get biometric entry through MLB’s Go-Ahead Entry

Major League Baseball continues to grow its facial recognition entry program with biometrics from NEC. An article in Sports Business…


Inrupt enters growing digital wallet market with pitch from WWW inventor

Inrupt has launched a digital wallet, which comes with a notable endorsement from an internet pioneer. A press release says…


OIX calls on new UK government to accelerate digital ID rollout

The UK should work toward a digital wallet strategy, provide clarity on how ID will work across the public and…


Leave a Reply

This site uses Akismet to reduce spam. Learn how your comment data is processed.

Most Read This Week

Featured Company

Biometrics Insight, Opinion

Digital ID In-Depth

Biometrics White Papers

Biometrics Events