Vianet ISP Breach Exposes 94,353 Customer Records in Nepal
What Happened — In April 2020 the Nepalese internet service provider Vianet suffered a data breach that released 94,353 unique email addresses along with associated names, phone numbers, and physical addresses. The breach affected roughly 177 k customer records overall.
Why It Matters for Trust & Control Assurance
- Demonstrates the risk of inadequate identity and access controls that allow unauthorized extraction of personal data.
- Highlights the need for continuous evidence that access‑control policies (least‑privilege, MFA, regular review) are enforced and auditable.
- Shows how a defensible audit trail of access‑control events can reduce investigation time and support regulatory reporting.
Who Is Affected – Telecommunications/Internet Service Providers (TELCO) handling consumer personally identifiable information.
Recommended Actions –
- Review and tighten authentication mechanisms for internal systems (enforce MFA, enforce strong password policies).
- Implement continuous monitoring and logging of privileged access, and retain logs for forensic review.
- Conduct a gap analysis against the “Identity & Access Management” control objective and collect evidence for audit readiness.
Technical Notes – The public disclosure does not specify the exact attack vector; no CVE or malware indicator was provided. Exposed data types include email addresses, names, phone numbers, and physical addresses. Source: Have I Been Pwned – Vianet breach