Hackers looking for a new loophole... Successive attempts to make fraudulent payments through financial platforms

A domestic fintech platform that provides corporate card issuance and spending-related services to startups suffered a hacking attack, leading to a series of fraudulent payment attempts using corporate cards from some credit card companies.

As serial hacking attacks in the financial sector continue, hackers are finding new detours every day and continuing intrusion attacks in various ways.

According to the financial sector on the 9th, a breach occurred at Gowid, a business-to-business (B2B) fintech company, on the 27th of last month, and personal information and billing information of customers in charge were leaked.

According to a notice from Gowid immediately after the incident, an abnormal recurring payment and infringement incident was confirmed on the 27th of last month, and it occurred in the billing and payment function for the Google Workspace (GWS) subscription fee among the 'Expenditure Optimization' services.

Expenditure optimization is a service that discounts and manages major business software-as-a-service (SaaS) subscription fees and IT equipment costs to reduce fixed costs for startups.

It was discovered that the hacker stole administrator information limited to the service in question, created a virtual electronic document, and requested payment.

As a result, abnormal fraudulent payments were attempted with corporate cards from multiple credit card companies, and it was found that some credit card companies even actually approved them.

After confirming the hacking circumstances, Godowed canceled the entire approved payment. Card companies also blocked additional payment attempts or canceled already approved payments through the Abnormal Transaction Detection System (FDS), which did not lead to actual fund outflow damage.

The credit card company where the fraudulent payment occurred reissued the customer's corporate card to prevent damage.

However, as Gowid is a B2B fintech company, it is not subject to direct inspection by the Financial Supervisory Service. Accordingly, the Financial Supervisory Service is said to be investigating the exact circumstances of the accident through individual financial companies where fraudulent payments occurred.