Bangladesh's City Bank Confirms Exploitation of Statement Portal Authentication Flaw

According to The Daily Star, citing confirmation from City Bank, an anomaly occurred on its statement portal on January 2, 2025, allowing an actor to bypass authentication and view other customers' statements ^[1]. The bank stated that access was limited to accounts whose account numbers were already known to the actor, and that the issue was remediated and relevant sessions terminated ^[1]. The bank emphasized that the portal only generates statements and cannot be used to execute transactions or other unauthorized financial operations ^[1].

Industries mainly affected: Finance

The bank emphasized that the portal only generates statements and cannot be used to execute transactions or other unauthorized financial operations ^[1].