Cyber Incident Victim: Banco del Estado de Chile
Date:
May 2018
Location:
Chile
Summary
Hackers stole $10 million from a Chilean bank, primarily transferring funds to Hong Kong, though customer accounts remained unaffected. The attackers deployed a virus as a diversion, prompting the institution to disconnect thousands of computers to safeguard client data. Simultaneously, they exploited the SWIFT network to initiate fraudulent international transfers, which were detected and halted after partial execution. Forensic analysis attributed the breach to a sophisticated transnational group likely based in Eastern Europe or Asia. The bank pursued legal action in Hong Kong and collaborated with insurers to recover losses.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 2 techniques |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
On May 24, 2018, Banco de Chile (Bank of Chile) disconnected approximately 9,000 computers across its branch network after detecting a virus deployed by hackers. This action was taken as a protective measure to safeguard customer accounts after the malicious software triggered security alerts. While the bank focused on containing this apparent threat, attackers simultaneously executed a separate scheme using the SWIFT global banking messaging system to initiate unauthorized international transfers. These fraudulent transactions remained undetected initially, allowing millions to be transferred out of the bank before security teams identified and canceled the transfers. Forensic analysis conducted by Microsoft determined the attack originated from a sophisticated international hacking group, with investigators attributing likely origins to Eastern Europe or Asia based on technical evidence. The bank confirmed $10 million was stolen, with most funds routed to accounts in Hong Kong.
The cyberattack caused Banco de Chile’s shares to decline by 0.47% to 100.4 Chilean pesos in mid-day trading on June 11, 2018, following public disclosure of the incident. CEO Eduardo Ebensperger emphasized that no client accounts were compromised, stating the attackers targeted institutional funds rather than customer assets. The bank filed a criminal complaint in Hong Kong to pursue legal recourse regarding the stolen funds. In its May financial statement, Banco de Chile indicated it would collaborate with insurers to recover financial losses from the heist. Ebensperger characterized the incident as an attempt to damage the bank directly, noting the distraction virus and SWIFT fraud demonstrated coordinated tactics to bypass security protocols during the operational disruption.