The data of 10 Crore Indian cardholders has been sold on the Dark Web for an unknown amount. The information has been disclosed by the independent cybersecurity researcher Rajshekhar Rajaharia who further stated that ‘hackers attacked the server of Bangalore-based digital payments portal Juspay and after the server was compromised they leaked the data of 10 Crore Indian debit and credit card holders on Dark Web’.
Juspay stated to IANS that people are being misinformed through media which has been telling users not to worry about their financial information. There has been no data leak regarding the card numbers and the victims of cyber attacks are much lower than the 10 Crore mark, media stated.
While giving insights into the security incident, Juspay told, “on August 18, 2020, an unauthorized attempt on our servers was detected and terminated when in progress. No card numbers, financial credentials or transaction data were compromised; some data records containing non-anonymized, plain-text email and phone numbers were compromised, which form a fraction of the 10 Crore data records”.
However, Rajshekhar Rajaharia was of different opinion and in relation to that, he said, the financial information of all 10 Crore cardholders is in jeopardy if the attackers can detect the Hash algorithm which is used to develop the card fingerprint and by using this algorithm they can decrypt the concealed card number.
Juspay was launched by the two former Amazon engineers Ramanathan RV and Vimal Kumar in August 2012 and was later joined by Bloomberg executive Sheetal Lalwani. The company has raised a total of $21.6M via funding and the last funding round was in March 2020.
The data revealed on the Dark Web contains ‘confidential information regarding debit and credit cards of cardholders including expiry date, card fingerprint, ISIN, the type of card, users' card brand (VISA/Rupay/Mastercard), the last four digits of the card, and user account ID.
The company spokesperson acknowledged that only a few contact numbers and email addresses have been leaked which have little to no value; According to him, no sensitive information regarding card numbers was accessed. He further asserted that no transaction or order information was compromised.
