Fivot announced on October 13 that its cashless service, IDARE, had been subjected to unauthorized access by a third party, resulting in the external disclosure of users’ personal information.
Vulnerabilities in external software introduced for operations such as customer support were exploited, allowing database information to be extracted on multiple occasions between August 10 and September 27. The company has now blocked the route used for the unauthorized access, discontinued use of the software in question, and completed updates to the related authentication credentials. No further unauthorized access has been confirmed.
Those affected are 129,659 users, including former users, who registered for IDARE by September 27. The leaked information includes registered details for all affected users, such as telephone numbers, email addresses, dates of birth, user IDs, and display names; account settings and status information; balance information; transaction histories; and the names and expiration dates on IDARE cards.
For some affected users, the leaked information also includes details submitted during identity verification, such as names, addresses, gender, purposes of use, and identity verification document numbers; the last four digits of IDARE card numbers; the first six and last four digits of credit card numbers registered for deposits; the last three digits of bank account numbers registered for deposits; and activation codes for physical cards.
However, identity verification documents and facial image data, login passwords, full IDARE card numbers, security codes, and PINs, as well as full numbers, security codes, expiration dates, and PINs for registered credit cards, and full bank account numbers and PINs, were not leaked. My Number information was also not compromised.
Fivot stated that, at this time, no fraudulent transactions resulting from the incident have been confirmed, users’ balances remain protected, and the service can continue to be used as normal. As multi-factor authentication is mandatory for login, the company said that a third party cannot gain unauthorized access to an account using only the leaked information.
To prevent a recurrence, Fivot will establish systems for continuously monitoring software vulnerability information and for monitoring and alerting on access logs, accept third-party investigations by external experts, and strengthen its information management framework.
Affected users will be notified individually by email. Inquiries are being accepted through the “Contact Us” section of the app or via the form on the website.
Notice
This article was generated using automatic translation by GPT-4 API. The translation may not be accurate.
