State Securities Commission (SSC) is warning securities firms that several criminals have been exploiting security holes to hack into their IT systems.

The SSC is concerned that the criminals have already obtained some pieces of identity information, including the user name and password of several clients.

With such information, they will take control of the client's securities accounts and steal their money through various transactions, including money transfer, money withdrawal and stock trading.

Accordingly, the commission has sent official documents to securities firms urging them to promptly find and fix any security vulnerabilities in their IT systems, particularly in online securities trading systems and other internet-connected systems.

The commission also urges securities firms to revise the transaction authentication process to reduce transaction risks. It suggests instant OTP verification for money transfer, money withdrawal, and any securities accounts changes.

Securities firms are also called on to put out warnings about identity thefts and request their clients to immediately change their current securities account passwords for security reasons.

Lastly, SSC recommends that securities firms keep their clients well-informed about the risks of personal data leaks and suggests ways to reduce such risks, including frequently changing securities accounts passwords and not sharing the passwords with accounts of different types.

Nguyen Son Hai, manager of Viettel Cyber Security, revealed that the system Threat Intelligence developed by his organisation detected 16 large-scale data leaks in Viet Nam in the first nine months of 2021, twice the figure in 2020.

The total number of leaked accounts amounted to about 97,000, including bank accounts and securities accounts.

"About 2,000 leaked accounts were bank accounts and securities accounts. Among those accounts, one bank account had a balance of VND5 billion (over US$218,600), and one securities account had VND30 billion," the manager said. — VNS