Attacker claims massive identity attack on PII at HSBC USA

A threat actor reportedly claimed to have stolen a trove of personally identifiable information (PII) from HSBC USA customers, making it potentially a serious identity attack that could affect millions of banking customers.

The exfiltrated data alleged to have been stolen includes full names, physical addresses, email addresses, Social Security numbers, dates of birth, and mobile, home, and work phone numbers.

“If the HSBC USA breach claims are true, a ‘PII attack’ is essentially an identity attack,” said Noelle Murata, senior security engineer at Xcape, Inc. “With enough personal information, attackers can bypass knowledge-based security, manipulate call centers, take over account recovery, and even create fake identities to open accounts or launder money.”

Murata added that this stolen PII also can fuel further fraud, like SIM swaps to intercept one-time passwords, changes to addresses and beneficiaries, tax and loan scams, and credential stuffing paired with password resets. Murata said security teams should anticipate data reuse and switch to phishing-resistant MFA (like FIDO2), strengthen account recovery verification, analyze profile change patterns, and quickly notify customers with options to freeze accounts and monitor activity.

“When PII is exposed, authentication becomes a matter of proving you're not an imposter,” said Murata. “Providers need to make it extremely difficult, both mathematically and operationally, for adversaries to succeed. Steal my PII and you don’t just know me — you can pretend to be me. Your controls must make that performance impossible.”

Shane Barney, chief information security officer at Keeper Security, said that any organization managing sensitive data or payments should assume they are a target.

“For financial institutions in particular, administrator accounts and SaaS platforms are prime targets for theft and extortion, making strong security controls an urgent focus,” said Barney.

Barney said security teams should focus on the following three priorities:

“These attacks thrive on human trust and excessive privileges,” said Barney. “Organizations that strengthen identity security and implement a robust privileged access management platform will be better positioned to withstand this evolving threat.”