Masked card data of 3.5 crore Indians breached, not 10 crore: JusPay

New Delhi, January 5

Bengaluru-based digital payments gateway JusPay on Tuesday said that about 3.5 crore records with masked card data and card fingerprint were compromised by a hacker and the claim of 10 crore cardholders’ data being affected was “incorrect”.

Responding to claims made by independent cyber security researcher Rajshekhar Rajaharia on Sunday that data of nearly 10 crore credit and debit card holders in the country was being sold for an undisclosed amount on the Dark Web – leaked from a compromised server of Juspay – the company said in a fresh statement that none of its merchants and their customers were at any risk.

“The masked card data is used for display purposes on merchant UI and cannot be used for completing a transaction. A part of user metadata in our system which has non-anonymised, plain-text email IDs and phone numbers got compromised,” the company informed.

“On August 18, 2020, an unauthorised attempt on our servers was detected and terminated when in progress,” it added.

According to JusPay, no full card numbers, order information, card PINs and passwords were leaked.

“We conducted a thorough audit on the day of the incident which confirmed that our ‘Secure Data Store’, which hosts the 16-digit encrypted card numbers, was not accessed and remains secure. The cyber-attack was identified in an isolated/separate system,” JusPay elaborated.

“We can confirm that the compromised data does not contain any transaction or order information, as the intrusion was terminated before such an access.”

Rajaharia had told IANS that the data was being sold on the Dark Web for an undisclosed amount via crypto-currency Bitcoin.

“For this data, hackers are also contacting via Telegram,” he said, adding that if the hackers can find out the hash algorithm used to generate the card fingerprint, they will be able to decrypt the masked card number.

“In this condition, all 10 crore cardholders are at risk,” Rajaharia noted.

JusPay said that it had made significant investments in security and data governance and its policies were aligned to globally accepted data protection standards.

“We did identify gaps in some of the older access keys and moved them to non-access key-based authentication supported by hosting providers. We have also made two-factor authentication (2FA) mandatory for all the tools accessed by our teams,” said the company.

According to Saurabh Sharma, Senior Security Researcher (GReAT), Kaspersky (APAC), data leaks due to internal vulnerabilities has become a common instance in India, especially in the last two years.

“Enterprises and institutions have begun to understand the importance of having a strong security framework to save themselves from an external attack by a cybercriminal. However, they tend to overlook the internal vulnerabilities that can prove to be  very damaging to their reputation and business if exploited by the bad guys,” Sharma told IANS.

Regular network and server evaluation, proactive detection of zero-day vulnerabilities and patching them immediately, launching attractive bug-bounty programmes and promptly informing the users of a potential leak are some of the “mandatory steps that  large enterprises and institutions should follow in order to stay away from cybercriminals and save their reputation”, he added. IANS