Crédit Populaire d'Algérie Claims 30 GB Exfiltration

Overview

On 8 June 2025, a DarkForums user using the handle TajineSec-MA claimed that Crédit Populaire d'Algérie (CPA), one of Algeria's largest banks, had been compromised. The post states that more than 30 GB of sensitive data was exfiltrated and that a 500 MB sample would be released as proof.

What was published

The claimed exfiltration includes:

• National ID documents
• Confidential employee and customer information
• Bank account and money transfer records
• Internal administrative documents (the Algerian state owns 70% of the bank)

The post is presented as the first official statement of the TajineSec group and indicates a 500 MB sample would follow. No download link was present at the time of capture.

Risks for affected individuals

• National ID documents enable identity fraud at scale.
• Bank account records could feed financial fraud and social engineering.
• Employee data increases risk of targeted attacks against bank staff.

What remains unknown

• Whether the claimed 30 GB was actually exfiltrated and whether the sample was released.
• The number of customers and employees affected.
• The bank's official response to the claim.

What affected people should do

CPA customers should monitor their accounts for unauthorized activity, be alert to phishing referencing their bank, and contact the bank through official channels if they suspect fraud.