The information of over 100 million credit and debit cardholders have been found on the dark web, revealed by cybersecurity researcher Rajshekhar Rajaharia. According to Rajaharia, the sensitive data appears to be connected with Juspay, a payments platform.
The cybersecurity researcher said that the data being sold on the dark web asks for an undisclosed amount of Bitcoin. Hackers have reached out via Telegram to contact interested or potential buyers, reports Gadgets 360.
Meanwhile, the massive information leaked on the dark web has been found linked to the compromised server of Juspay. Juspay is a Bengaluru-based mobile payments solutions firm and digital payments gateway.
Inc42 states that Juspay is used to processed payments for various merchants, including both local Indian businesses and global ones such as Amazon, Airtel, Cred, Flipkart, MakeMyTrip, Ola, Swiggy, Uber, and Vodafone.
Juspay has since acknowledged the data breach, saying that a part of its database has been affected since August 2020.
In a statement to Inc42, a spokesperson from Juspay said, “On August 18, 2020, an unauthorised attempt on our servers was detected and terminated in progress. No card numbers, financial credentials, or transaction data were compromised. Some data records containing non-anonymised, plain-text email, and phone numbers were compromised, which form a fraction of the 10 Cr data records.”
The founder of Juspay, Vimal Kumar, also maintained that the 10 crore records were safe as their “card vault is in a different PCI compliant system and it was never accessed.” This entails that the masked card information obtained came from a wholly separate server.
Gadgets 360 said that the sensitive data found on the dark web included transactions that ran from March 2017 until August 2020.
Some of the data that pertains to the aforementioned information includes full names of individuals, as well as the phone numbers and email addresses of cardholders. Apart from this, the first and last four digits of their debit and credit cards have also been compromised, revealed Gadgets 360.
Moreover, the news site also said that the leaked details of Indian cardholders also included other information. These include customer IDs, masked card numbers with the first and last four numbers visible, as well as the card expiry dates.
While the general transaction or order details have not been included, Gadgets 360 said that hackers could leverage the details found on the dark web to launch phishing attacks and other similar schemes.
