Seychelles Commercial Bank Confirms Customer Data Breach

A hacker claims to have stolen and sold the personal data of clients of Seychelles Commercial Bank. The bank, which provides personal and corporate services on Seychelles, one of the world’s smallest countries, notified customers of a hack, but said only personal information – not money – was stolen.

See Also: On Demand | From Patch to Prevention: Modernizing Remediation Across Hybrid Environments

The archipelago nation in the Indian Ocean, located northeast of Madagascar, sports 98,000 inhabitants, ranks as the richest country in Africa and has a reputation for being a tax haven.

Seychelles Commercial Bank on Friday said it “recently identified and contained a cybersecurity incident, which has resulted in its internet banking services being temporarily suspended,” and requested customers “make use of our ATMs or visit one of our branches during normal banking hours.”

In its breach notification, the bank told customers: “SCB regrets to inform that this cyber incident resulted in unintentional exposure of personal information of internet banking customers only. The bank reassures all its internet banking customers that no funds have been accessed.”

The bank didn’t immediately respond to a request for comment from Information Security Media Group about when the attack began or to what extent and when it “contained” the breach.

The breach appears to have first come to light publicly on July 4 via cybercrime marketplace DarkForums, when the user “ByteToBreach” posted for sale a “Seychelles main bank clients leak.”

The listing read in part: “I currently have the data of the clients of this bank, with DOB, phones, names, addresses, emails etc. Unfortunately, the password for the employee’s pins and passwords, as well as regular users, everything is encrypted and secured with extra layers. Decryption is impossible to my knowledge, despite having the AES key. If anyone have experience cracking FCDB, there’s very serious data involved (government balance account is listed among the entries).”

FCPB – sometimes referred to by the attacker as FCDB – is the Oracle Flexcube Private Banking application used by SCB as its banking software, including for providing customers with online access to their accounts and the ability to perform transactions.

Researchers at Los Angeles-based cybersecurity firm Resecurity engaged with the attacker, and reviewed a sample of stolen data. They said it appears to contain numerous customer names, email addresses, phone numbers, type of account and account balances. Multiple accounts are also labeled “current accounts – government.”

Whether the leaked data is genuine has yet to be confirmed by the bank, which apologized to customers for the breach.

ByteToBreach told Information Security Media Group they first breached the bank’s network on Feb. 5, 2025, then returned on July 3 and began exfiltrating data through July 4, ultimately stealing 2.2 gigabytes of customer data.

The attacker claimed to have hacked the bank through a vulnerability in Oracle WebLogic Server that they declined to specify. “I had to download PDF manuals for Oracle FCDB to understand the setup, since it was reasonably secure network,” ByteToBreach said. “There is also Fortinet on top of that.”

The hacker also claimed to have successfully decrypted some of the stolen data, using decryption keys stolen from the bank’s IT environment. “The decryption keys were easily accessible, but we’re useless initially. After reading Oracle’s docs, decrypted some of the data,” they said.

The attacker claimed to have heard “absolutely nothing” from the bank after attempting to communicate with the company, including demanding a ransom, “which is why I publicized it so much,” adding that, “I usually leave the victim alone once I receive a payment.”

ByteToBreach was attempting to further extort the bank by contacting customers directly, using email addresses obtained in the data breach. “I am writing to inform you that your personal data has been compromised by SCB Bank, and they are covering this up. Contact them for explanations,” reads a message sent to a subset of bank customers on July 8.

The individuals listed on that email trail didn’t immediately respond to a query about whether they are legitimate bank customers.

ByteToBreach claims to have sold the set of stolen data at least once for about $750 in bitcoin, and was also approached to share their “access” to the bank, which they sold for $6,000. “But it turned out there were no more access and I didn’t have enough willpower to resend the bitcoins,” they said.

The bank told customers it’s been working with police to investigate the intrusion, as well as putting “additional cybersecurity safeguards” in place, “including but not limited to suspending its internet banking platform and other mitigation measures” until those fixes are in place.

The breach could be notable because of the Seychelles’ approach to tax liability pertaining to bank deposits. Based on the jurisdiction’s laws and regulations, the Seychelles “currently ranks 45th on the Corporate Tax Haven Index, which ranks the world’s biggest enablers of global corporate tax abuse,” says the Tax Justice Network.

The International Consortium of Investigative Journalists, in a 2014 report, described the Seychelles as being “an offshore magnet for money launderers and tax dodgers.”

The Seychelles Commercial Bank data leak raises the possibility of Seychelles facing its own version of the “Panama Papers” leak in 2016. In that incident, an anonymous source leaked 11.5 million documents from Panama-based law firm Mossack Fonseca, which reportedly helped numerous individuals and organizations create offshore shell companies. The documents revealed alleged money laundering, tax avoidance and sanctions dodging by politicians, owners of mega-corporations and fraudsters (see: If You Hide It, They Will Hack).