Banco Pichincha Peru faces alleged SQLi breach

An actor identified as Returnero claimed to have compromised Banco Pichincha Peru through SQL injection and offered banking data and access to other sites. The claim was not confirmed by the bank or independently verified. At the same time, other accounts circulated an alleged leak tied to the institution, with samples said to include names, email addresses and customer-linked records, also without official verification.

What was claimed about Banco Pichincha Peru?

Returnero said they had accessed Banco Pichincha Peru's site through SQL injection and had banking data. The post, according to the material reviewed, also offered access to other sites. The available source, however, makes clear that there is no confirmation from the bank or independent verification of either the access or any data exposure.

The most widely shared attribution in the case came alongside other posts that reinforced the leak theory, but always on unconfirmed grounds. Among them was Alph4, which spoke of a supposed database linked to the entity, and CyberPulse, which described an alleged database containing customer information samples.

What did the other posts say?

Alph4 published an alert attributing an alleged data leak linked to Banco Pichincha Peru to Returnero. The post mentioned registration dates, names and email addresses as possible exposed data, but it did not state the size of the database or provide independent validation.

CyberPulse took a similar line and described an alleged database linked to the bank. According to that account, the samples supposedly included customer names, banking-related records and possible personal information. The post itself marked the authenticity, the number of affected users and the SQL injection vulnerability as unverified.

What context is there in Peru?

The available material does not include an official confirmation of this case, but it does place it in a setting where alerts about data theft and credential abuse are circulating. The suggested source for the editorial angle also points to a reported rise in card fraud and to impersonation tactics used to obtain personal data or money in Peru.

No figures, sanctions or institutional response from the bank appear in the information provided for this note. What stands out for now is that the episode remains between claims attributed to third parties and the absence of independent verification, both of the supposed access and of the real scope of any potential leak.