Data breach: Hitachi admits malware attack hit systems

Tribune News Service

New Delhi, February 9

In the investigation of the breach of 32 lakh debit cards last year, Hitachi Payment Services today said it suffered a breach due to a sophisticated malware attack.

Hitachi provides the ATM payments network for several banks. SISA Information Security has completed its final assessment report on the reported breach of security protocols which led to the potential compromise of debit cards.

The report pointed out to a sophisticated injection of malware (a piece of malicious software code) in the Hitachi Payment Services’ systems, which was able to compromise the details of these debit cards.

In a statement, Hitachi Payments said the malware, being sophisticated in its design, had been able to work undetected and had concealed its tracks during the compromise period.

However, the extent of the data breach is not known. “While the behaviour of the malware and the penetration into the network has been deciphered, the amount of data exfiltrated during the above compromise period is unascertainable due to secure deletion by the malware,” it said.

Loney Antony, Managing Director, Hitachi Payment Services said, “Despite following adequate security measures and adopting the standards of internationally accepted best practices in the business, we confirm that our security systems had a breach during mid-2016”.

“As soon as the breach was discovered, we followed due process and immediately informed the RBI, National Payments Corporation of India (NPCI), banks and card schemes. We also partnered with banks to ensure the safety of their customers’ sensitive data. As a result, the extent of compromise was limited and we have not seen any further misuse due to the containment measures deployed by Hitachi Payment Services”, he added.

Hitachi Payment Services said it regrets the inconvenience caused to banks and its customers due to this lapse in its security infrastructure.