A post circulated by VECERT on November 8, 2026, raised a new cybersecurity alert concerning Banco Pichincha. According to the report, an actor calling itself WhiteLotus claims to have extracted confidential information from the Ecuadorian financial institution. The claims encompass customer records, card information, authentication sessions and material relating to internal services. The post also mentions a possible offer to negotiate access associated with SWIFT, the financial messaging network used for international payments.
One point needs to be clear from the outset: this is an allegation made by a purported threat actor, not public proof that the bank suffered the intrusion described. At the time of publication, we had not found official confirmation from Banco Pichincha or an Ecuadorian authority validating the claims about WhiteLotus, their scope, the alleged samples or any SWIFT-related attack vector.
The information originates in a VECERT alert posted on X on November 8, 2026. The figures and technical artifacts described below are attributed to that source. EMA has not accessed banking systems, authenticated samples or conducted an independent forensic examination of the alleged files.
What WhiteLotus claims
The post alleges that the actor remained inside systems associated with the bank for over three months and obtained more than 100 MB of material across thousands of files. Its classification describes seven information tiers, from customer data to alleged traces of internal operations.
The allegations include:
- Financial and identity information. An alleged SQL dump comprising 104 files with full card numbers, identity records and cardholder names, plus 347 entries relating to Cash Management token requests.
- Personal data. A claimed 1,413 files containing 65,290 records allegedly associated with 7,683 unique identification numbers. The list purportedly includes names, addresses, telephone numbers, dates of birth and account details.
- Biometrics. A reported 123 files in a directory named
biometria_facephi/, allegedly containing biometric templates, photographs and software components. - Authentication. The report lists 2,840 files, including 296 items described as RS256 JWTs, 122 purportedly active session tokens, password exports and references to attempted password spraying.
- APIs and internal systems. The actor claims to possess API responses, internal server names, 271 public-key
.pemfiles, web application resources and execution traces.
None of these figures should be taken as a verified count of affected customers. One individual may appear in many records; files may be duplicated, old, synthetic, public or sourced from a third party. Without forensic analysis, their authenticity, provenance and current relevance cannot be established.
SWIFT: the claim requiring the greatest caution
The SWIFT reference is perhaps the most sensitive element of the allegation. However, mentioning a supposed access vector or an intention to sell it is not evidence that SWIFT infrastructure was compromised. Nor does it demonstrate that payment instructions were created, modified or transmitted.
Claims of that seriousness require verifiable evidence of access, scope, system integrity and transaction activity, assessed by specialists and relevant authorities. The text of the alert alone provides no such confirmation.
What the technical artifacts do—and do not—mean
Some technical terms in the post can create an impression of greater certainty than the evidence supports.
A .pem file does not necessarily mean a private key has been compromised. The report refers to public keys, which may be distributed by design. Their content and purpose must be assessed before they are characterized as confidential credentials.
The presence of JWTs does not prove that any sessions can still be used. Tokens may have expired, been revoked, served only test purposes or lacked meaningful privileges. RS256 identifies a signing mechanism; by itself, it does not mean an attacker can forge identities.
Finding a biometric software development kit does not prove that biometric databases were stolen. Distributable code must be distinguished from actual biometric templates, personal samples and legitimately installed components.
These distinctions do not diminish the seriousness of a possible exposure. They prevent an uncorroborated allegation from becoming a technical verdict simply through repetition.
Historical context: distinct incidents must not be conflated
Banco Pichincha experienced a documented cybersecurity incident in October 2021. Ecuador’s Superintendencia de Bancos described its supervisory response, monitoring and requirement for a forensic audit at the time.
Claims involving Banco Pichincha in threat forums require independent verification before a breach can be attributed.
That prior incident does not confirm the November 2026 allegations. It also provides no basis to attribute the earlier event to WhiteLotus or suggest that the two episodes are connected.
In its 2025 sustainability report, Banco Pichincha described its risk management, threat detection and incident-response processes. That document provides institutional background; it is not a response to the latest allegation.
What is established and what remains unverified
| Established from open sources | Not verified |
|---|---|
| VECERT shared an alert attributing claims to WhiteLotus | That WhiteLotus accessed the bank’s systems |
| The post includes specific figures and categories of alleged data | That the described files exist as claimed or are authentic |
| The alert mentions a possible SWIFT-related vector | That operational SWIFT access or payment manipulation occurred |
| An unrelated incident was officially documented in 2021 | That the earlier event is connected to the new allegations |
What customers should do
There is insufficient public evidence to conclude that all accounts or cards have been compromised. Still, sensible preventive measures remain appropriate:
- Review transactions and notifications through the bank’s official app or website, never through links contained in alarming unsolicited messages.
- Enable available transaction alerts and promptly report unrecognized charges through official channels.
- Use unique passwords and enable any additional authentication methods provided by the bank.
- Never share passwords, verification codes or full card details over the phone, WhatsApp or forms sent by third parties.
- Be wary of supposed tools offering to check whether an ID number or card is “in the leak” in exchange for personal information.
If exposure of customer credentials or cards were confirmed, the bank and competent authorities would need to determine the scope and communicate specific measures. There is no reason to cancel cards en masse based solely on an unverified online post.
What incident-response teams should investigate
For a SOC or CSIRT, the priority would be preserving evidence and testing hypotheses, not assuming that every item in the published inventory is authentic. Relevant checks would include access and identity logs, critical system integrity, session management and selective revocation, any genuinely exposed private credentials and telemetry from internal services. A focused assessment of international payment environments could confirm or exclude any SWIFT connection.
Indiscriminate key rotation or blanket session revocation without operational assessment could also disrupt services. Such decisions belong to the team responsible for incident response.
The circulation of information is itself a risk
Extortion forums may mix authentic information, recycled datasets, third-party samples and claims designed to apply pressure. A detailed post can warrant urgent investigation, but detail is not a substitute for independent validation.
This story will remain an alert under verification unless corroborated technical evidence or an official statement allows the facts to be established. EMA will update this article if new verifiable sources emerge.
Sources and traceability
- VECERT / @vecertradar, November 8, 2026 post — primary source for the allegation, not independent confirmation.
- Superintendencia de Bancos: response to the 2021 incident — independent historical background.
- Banco Pichincha: 2025 sustainability and annual report — institutional context predating the alert.
- Lupa Media: how to interpret VECERT alerts — commentary on the importance of independently verifying this type of report.
Editorial note (November 8, 2026): claims concerning WhiteLotus remain independently unconfirmed. This article publishes no alleged data samples, credentials, card numbers or personally identifying technical indicators.