Supplier breach exposes 1.4 million prepaid card records in Japan
Paycloud says attackers exploited a web-server vulnerability at subsidiary Value Design, exposing 1,424,748 Value Card records with card ID, PIN and balance. MOS Burger separately confirmed 1,133,070 MOS Card records exposed through the supplier and forcibly changed the affected PINs. Paycloud says the access route was blocked and no misuse losses were reported as of its Oct 23 disclosure.
What happened
Paycloud, a payment supplier in Japan, says attackers exploited a web-server vulnerability at its subsidiary Value Design. The incident exposed 1,424,748 Value Card prepaid card records with card ID, PIN and balance. MOS Burger separately confirmed 1,133,070 MOS Card records exposed through the same supplier.
Why it matters
Exposed card ID, PIN and balance allow misuse of stored value: 569,224 Value Card IDs had been issued and about 570,000 MOS cards were in circulation. These are store-branded prepaid cards, with no bank cards involved. MOS Burger says names, addresses, phone numbers and credit-card details were not exposed.
What to do
Monitor balances and transaction history of affected cards. MOS Burger has already forcibly changed the affected PINs and asks customers to review their transactions. Check with payment suppliers whether any of your own card programs were hit by this flaw.
For the technical team
- Affected
- Paycloud / Value Design (fornecedor de pagamentos no Japão) Value Card e MOS Card (cartões pré-pagos de loja no Japão) · Value Card (store-branded prepaid card): 1,424,748 records, 569,224 of them issued IDs. MOS Card: 1,133,070 records, about 570,000 of them cards in circulation. Overlapping record counts, not unique people.
- Exploitation
- Paycloud says no misuse losses were reported as of its Oct 23 disclosure. No CVE, PoC or ransomware attribution established.
- Fix
- No patch described in the sources. Paycloud blocked the access route; MOS Burger forcibly changed the affected PINs and asks customers to review their transaction history.
- Vector
- Web-server vulnerability at Value Design, a Paycloud subsidiary, per the company itself. The access route has been blocked; technical details of the flaw were not disclosed.
- More details
- Data exposed per record: card ID, PIN and balance. MOS Burger says names, addresses, phone numbers and credit-card details were not exposed. Origin: Paycloud disclosure on Oct 23 and a separate MOS Burger confirmation.
Timeline
Incident opened.
Sources 1 source
- @DailyDarkWeb @DailyDarkWeb
