City Bank clarifies misleading claims about customer data

In recent days, certain media outlets have propagated misleading information suggesting that the customer data of City Bank has been sold on the dark web. This misinformation, based on a minor technical glitch (which caused neither financial loss to the bank nor to its customers), is both unwarranted and misleading. To clarify the situation and dispel any rumours, we are issuing this notice.

What Happened?

A few days ago, a minor issue occurred in our statement portal due to a system glitch. This portal, designed solely for viewing account statements via two-factor authentication (2FA), does not allow any financial transactions. On January 2, we were alerted by a government cybersecurity agency about this issue. Due to the glitch, a hacker was able to access one or a very limited number of account statements by exploiting the system's sudden failure to send an OTP (One-Time Password) to the rightful account holder during an unauthorised access attempt. However, this unauthorised action by the hacker did not impact customer accounts or financial transactions in any way. As soon as the issue was brought to our attention, we immediately resolved the problem.

Actions Taken

All unauthorised sessions on the portal were terminated immediately. The system glitch was fixed, and additional security measures were implemented. Our real-time cybersecurity monitoring team was further strengthened to ensure vigilance against future incidents.

Customer Assurance

We assure our valued customers that:

• All their financial information remains completely secure;
• No financial loss of any kind occurred;
• Only one or a very limited number of account statements (not accounts) were accessed;
• Our core banking systems remain uncompromised;
• No customer information was sold on the dark web.

We have taken robust measures to prevent any such incidents in the future and to uphold the highest standards of cybersecurity. Thank you for your continued trust in City Bank.