Your papers, please. This Thursday, October 8, BasedApp confirmed an intrusion that occurred at the heart of its infrastructure. In a press release published on X (Twitter), the Singaporean fintech confirms the worst scenario. KYC data of certain Visa card holders could have been stolen. However, the funds remain intact, in a context where Denmark recently identified 8 million national identifiers exposed.
The key points of this article:
On Monday October 5, Based detected that an unauthorized third party was accessing an internal dashboard of its Visa card program.
KYC data of certain holders, including name, passport number, date of birth and address, could have been obtained by the attacker.
Card numbers, CVVs, PINs, ID photos and Based Wallet funds are not affected by the incident.
The company calls on affected customers to be cautious of future spoofing and social engineering attempts.
An intrusion into the heart of the card program
As a reminder, Based (SHA2 Labs) is a Singaporean fintech application that combines wallet, trading and Visa card of the same name. On Monday, the team learned that an unauthorized actor had successfully breached an internal dashboard, used to administer the card program. The attack was “quickly stopped and contained” upon its discovery, assures the company.
In fact, it is the KYC (know your customer) data collected by the card issuer that is targeted. Name, identity document or passport number, date of birth and address appeared in the potentially exposed perimeter. The company specifies that only “certain carriers” are concerned, without disclosing any figures. Separately, affected customers received an email on Thursday, while the relevant authorities were informed of the incident.
Funds intact, but a very real risk of usurpation
On the good news side, the list of elements spared is rather reassuring. Card numbers, CVVs and PINs were not leaked, nor were ID photos and liveness check images. The Based Wallet, which is used for trading, escapes the incident, and the funds on the card remain accessible. Additionally, Visa payments continue to operate normally.
However, identity data is enough to fuel very credible social engineering campaigns.
“If you are one of the affected users, consider this data compromised. »
The team therefore reminds that support goes exclusively through the chat integrated into the application, and that no member will contact users by private message on Telegram or X.
In practice, the press release also assumes a singular choice. The team says it “purposely” disabled comments on the post for security reasons. A way to cut short fake support agents, a classic of the genre. Indeed, the mechanics are known, since a cyberattack targeting Oracle had already exposed the health data of nearly 20 million people last week.
