fintech · BleepingComputer
Polish authorities arrested four members of an organized cybercrime group accused of conducting SIM-swapping attacks that resulted in millions of dollars in cryptocurrency theft. The Polish Cybercrime Bureau (CBZC), working with the FBI and Homeland Security Investigations, found that the suspects breached telecommunications partners and employee email accounts using specialized software and social engineering techniques. They hijacked victims' phone numbers, intercepted SMS and email communications, and gained unauthorized access to cryptocurrency exchange accounts. The stolen funds were laundered through multiple bank accounts and digital wallets across various countries, with investigators estimating losses exceeding several tens of millions of Polish złoty (at least $5 million USD).
This case underscores critical vulnerabilities in account recovery and identity verification workflows that affect regulated industries. SaaS platforms offering financial services or cryptocurrency access must ensure multi-factor authentication mechanisms cannot be bypassed through telecom partner compromises; SOC 2 Type II audits should verify controls around SMS-based recovery methods. Fintech and payment processors handling sensitive customer data need to assess whether their telecommunications suppliers have adequate access controls and monitoring to prevent employee account hijacking. Healthcare and defense contractors using phone-based MFA should review whether alternative authentication factors are available and whether vendor security requirements are contractually enforced. An Omniware engagement can scope your organization's exposure to telecom-based attack vectors and help design compensating controls aligned with your compliance obligations.
Source: BleepingComputer - https://www.bleepingcomputer.com/news/security/poland-busts-sim-swapping-gang-tied-to-millions-in-crypto-theft/
Source: BleepingComputer
All briefings