On the forum R*******, someone is selling over 17GB of personal data belonging to Vietnamese users. According to the seller, this data includes names, birthdates, profile pictures, home addresses, email addresses, phone numbers, ID card numbers, front and back photos of ID cards, and selfie photos/videos.
The exact number of affected Vietnamese users hasn’t been disclosed, but judging by the number of files, it could be close to 10,000 people. The price for this data is $9,000 USD (around 207 million VND). The seller only accepts payment in cryptocurrencies like Bitcoin or Litecoin.
What’s especially concerning is the seller’s claim that this 17GB of data was collected from Pi Network, a crypto mining app that has attracted a lot of attention in Vietnam recently.
It’s suspected that this data comes from Pi Network’s KYC (Know Your Customer) process. KYC is a common procedure for financial apps, requiring users to provide personal information to verify their identity.
For Pi Network, to mine Pi coins and claim ownership, users need to submit basic info like name, age, birthdate, and phone number, plus upload photos of their ID or selfies. Instead of handling KYC directly, Pi Network partners with another app called Yoti to verify user identities.
It’s still unclear whether the leak happened because of Pi Network itself, or if hackers exploited a vulnerability in Pi Network or Yoti to steal the data. Also, despite the seller’s claims, it’s not confirmed that the data actually came from Pi Network, since currently Pi Network and Yoti don’t accept ID cards for KYC, only driver’s licenses or passports.
So far, no one has bought the data, and the seller says “user information is still safe.” However, that could change at any moment, and the risk of this data being misused is very real.
Update: The forum post selling this data has been removed for unknown reasons. The seller’s account was also banned by the forum admins due to fraudulent behavior in another transaction.
