Qatar National Bank SQL Injection Breach Exposes 88,678 Customer Records
What Happened — In July 2015 attackers exploited a SQL‑injection flaw in Qatar National Bank’s public website, extracting 15 KB of documents (≈1.4 GB) that contained personal and financial data for 88,678 customers. The data set, which included passwords, PINs, government IDs and transaction details, was posted on a file‑sharing site in April 2016.
Why It Matters for Trust & Control Assurance
- The breach illustrates a classic control‑gap: insufficient secure‑development and vulnerability‑management practices, the very scenario a continuous control‑assurance program is built to detect and remediate.
- Continuous evidence of code reviews, automated scanning, and documented remediation provides a defensible audit trail across frameworks (e.g., NIST CSF 2.0).
- Mapping this incident to the “Secure Development & Vulnerability Management” control objective helps demonstrate due‑diligence to regulators and partners.
Who Is Affected — Banking and financial‑services institutions that expose web‑applications to customers.
Recommended Actions
- Perform a comprehensive application‑security assessment focused on input validation and injection defenses.
- Deploy automated, continuous vulnerability scanning and retain remediation evidence for audit readiness.
- Update incident‑response playbooks to include web‑application exploit scenarios and evidence‑collection steps.
Source: Have I Been Pwned – Qatar National Bank breach
Technical Notes — Attack vector: SQL injection exploiting a web‑application flaw. Data types exposed: account numbers, passwords, PINs, government‑issued IDs, financial transactions, personal demographics, IP addresses, security questions, etc. Source: same as above