User IDs and passport data leaks for 230K crypto users in Iran

A data leak from Iranian crypto exchange bit24.cash has exposed personal data from nearly 230,000 Iranian citizens, according to Cybernews.

Iran has taken up cryptocurrency significantly due to limited access to foreign markets. In 2023, Iranian crypto exchanges saw almost $3 billion in transactions.

Bit24.cash supports over 300 coins and tokens. Users complete a KYC process where they confirm their identity by uploading identity documents.

Cybernews researchers found a misconfigured MinIO that granted access to S3 buckets containing users’ KYC data. MinIO is an S3 compatible object storage system for large scale machine learning and data workloads.

The misconfiguration exposed users’ passports, ID documents, and credit cards, as well as written consent to regulations. The leak has since now been secured, according to the report.

“This breach poses a severe threat, as threat actors could potentially exploit the exposed data for identity theft, fraudulent transactions, and phishing attacks,” said the Cybernews researchers. “With access to such comprehensive personal and financial data, malicious actors could impersonate individuals, gain unauthorized access to accounts, execute fraudulent transactions, and potentially cause substantial financial and personal harm to the affected users.”

Hossein Amini, a security engineer at bit24.cash, officially responded to the claims on behalf of the company via email to Cybernews. The company says the claims are “inaccurate and misleading,” alleging it found no evidence of a data breach or unauthorized access to user information.

“The reference to a misconfigured MinIO instance granting access to S3 buckets containing KYC data is wholly untrue and does not align with our system architecture or security protocols,” said Amini. “We can confirm that our MinIO setup and cloud storage containers remain secure, and there has been no unauthorized access to any sensitive user data.”

An Ondato report delved into the relationship between ID documents and cryptocurrency fraud last year.

Article Topics

cryptocurrency  |  data protection  |  digital ID  |  identity document  |  KYC