[ITmedia News] Cashless service “IDARE” leaks personal information of about 130,000 people, including balances and transaction history

Fivot, which operates the prepaid cashless service IDARE, announced on October 13 that its users' personal information had been leaked to an external party due to unauthorized access by a third party. The target is 129,659 people who registered with IDARE by September 27th, including those who have already withdrawn their membership, and the information includes phone numbers, email addresses, balance information, transaction history, etc.

A vulnerability in external software used for customer support and other tasks was exploited, and database information was obtained multiple times between August 10th and September 27th. The company has blocked the route of unauthorized access, stopped using the software, and updated related credentials. No new unauthorized access has been confirmed as of the 13th.

For all of the affected individuals, registered information such as phone numbers, email addresses, dates of birth, user IDs, and display names, as well as account settings, balance information, transaction history, and IDARE card name and expiration date were leaked. For some users, application details such as name, address, and identification document number, the last four digits of the IDARE card number, the first six and last four digits of the credit card number registered for depositing, and the last three digits of the bank account number were also leaked.

On the other hand, the company says that login passwords, images of identity verification documents, all digits of each card number, security codes, and pin numbers have not been leaked because they are either managed in a way that cannot be referenced by systems that have been accessed illegally, or are not retained in the first place.

As of the 13th, we have not confirmed any fraudulent transactions that exploited the leaked information. Since multi-factor authentication is required for login, unauthorized login is impossible with just the leaked information, and the service can be used as usual. Targeted individuals will be individually informed via email of the scope of the leaked information.