The first message, from a burner account named markscottt47, arrived in the inbox of The Paraguay Post on August 14.
The writer of the email claimed to have hacked “critical” internal servers of Ueno, Paraguay’s leading high-street and digital bank, with well over two million clients.
Over the preceding 14 months, he added,
“we have obtained hundreds of millions of lines of data: all banking information of customers across the country, credit card details, transactions made and received, phone numbers, email addresses, home and work addresses, credit records … everything has been stolen.”
Copying in media outlets, Paraguayan authorities and Ueno executives, he presented himself as a “grey hat” hacker who had asked Ueno boss Federico Miguel Vázquez to pay an “insignificant amount”. The bank would then be allowed to quietly fix the vulnerabilities outside of the glare of the media.
But Ueno’s intransigence had left him “no other choice”. The “management and security of the bank”, he added, are “a handful of idiots.”
A batch of data subsequently posted on the dark web contained a quarter of a million lines of data seemingly belonging to Ueno customers, including transaction details on both ends, ID numbers and phone numbers.
Ueno denied that their internal systems had been breached, describing the supposed leaks as “malicious information” intended to sow confusion among customers. The bank said it was boosting security controls as a precautionary measure.
Yet one of those affected was congresswoman Johanna Ortega, who confirmed to our colleagues at Consenso and ABC Color that leaked information pertaining to her, including recent transactions, was accurate. Paraguay's banking regulator also launched an investigation.
Over the following days, further angry messages — now from an account named bruce wayne — threatened to leak sensitive data from ride-hailing app muv, food delivery company Monchis, and digital-ticketing firm tuti: all also part of the Grupo Vázquez conglomerate.
Attached were screengrabs from a Telegram chat — which the Post was unable to independently verify — in which a Ueno representative purportedly makes a “final offer” of US$100,000. Bruce wayne rejects the amount, demanding $350,000.
Then, after August 26, the emails and the leaks suddenly stopped.
“The bank of all Paraguayans”
Whatever the truth of the episode, Ueno is clearly an appealing target for digital bandits.
In the space of barely 18 months, the brand has muscled its way from being a millennial-friendly banking app to becoming a heavyweight in Paraguay’s financial sector, a physical feature in dozens of high streets — and a ubiquitous presence on TV, social media and public life.
The bank sponsors a dizzying array of businesses, brands, sports teams, public figures and events: trophy-winning F2 driver Joshua Duerksen, the recent Junior PanAmerican Games and World Rally Championship, Encarnación Carnival and Paraguay’s football team.
Not a paid subscriber? Sign up for the price of a coffee per month to read the inside story on Ueno’s accelerating takeover — and unlock dozens more Insider Insight articles and paywalled news stories on politics, business, economics and society in Paraguay:
Keep reading with a 7-day free trial
Subscribe to The Paraguay Post to keep reading this post and get 7 days of free access to the full post archives.