Ecuador’s Largest Bank Taken Offline By Cyberattack

Ecuador’s largest private bank Banco Pichincha has suffered a cyberattack that disrupted operations to the extent that ATMs and the online banking portal were taken out. The cyberattack occurred this weekend, causing Banco Pichincha to shut down parts of their network to halt the spread of the infection.

The shutdown of their systems due to the cyberattack lead to widespread disruptions, with ATMs and the bank’s online service showing maintenance messages.

In an internal notification sent to the Bank’s agencies, employees are notified that bank applications, email, digital channels, and self-services will not be operational due to a technology issue.

The document goes on to say that self-service customers should be directed to bank teller windows to be served during the outage.

After two days of silence regarding the outage, Banco Pichincha issued a statement Tuesday afternoon admitting that they suffered a cyberattack that led to the disruption of their systems.

The banks statement in English can be found here:

“In the last few hours, we have identified a cybersecurity incident in our computer systems that have partially disabled our services. We have taken immediate actions such as isolating the systems potentially affected from the rest of our network and have cybersecurity experts to assist in the investigation.

At the moment, our network of agencies, ATMs for cash withdrawals and payments with debit and credit cards are operational.

This technological incident did not affect the financial performance of the bank. We reiterate our commitment to safeguard the interests of our clients and restore normal care through our digital channels in the shortest possible time.

We call for calm to avoid generating congestion and to stay informed through the official channels of Banco Pichincha to avoid the spread of false rumors.”

Today, the only banking portal still shows a maintenance message but customers are able to access their online accounts. The mobile application is still shut down from the cyberattack.

At this time, the bank has not disclosed the nature of the cyberattack. However, researchers at BleepingComputer believe that it is a ransomware attack with threat actors installing a Cobalt Strike beacon on the network.

Ransomware gangs and other threat actors commonly use Cobalt Strike to gain persistence and access to other systems on a network.

In February, Banco Pichincha suffered another cyberattack by cybercriminals known as ‘Hotarus Corp’ who claimed to have stolen files from the bank’s network.

Pichincha disputed the hacker’s claims and said that one of their providers was breached instead.

“We know that there was unauthorized access to the systems of a provider that provides marketing services for the Pichincha Miles program,” Banco Pichincha said at the time.

“In relation to this information leak, and based on an extensive investigation, we have found no evidence of damage or access to the Bank’s systems and, therefore, the security of our clients’ financial resources is not compromised.”