Sensitive card data belonging millions of Indians has been compromised and leaked on the dark web due to a security comprise at a server used by Juspay, major payment gateway provider in the country. The incident, which took place due to failure in safeguarding a cloud database back in August 2020, has led to masked card data as well as sensitive customer data being breached, the company said in a blogpost. Inc42 first reported this. What exactly happened An old password for a database held within Amazon Web Services' (AWS) cloud servers was re-used On August 18, the company noticed unauthorised access to the database and the incident response team acted to stop the attack Data pertaining to 35 million consumers, which includes masked card data and card fingerprint data was leaked Partial access to meta-data from a database non-anonymised, plain-text email IDs and phone numbers was leaked Screenshots show 16 data fields from the type of card (debit or credit), card issuer card brand, expiry data, card token last four digits, masked card number name on the card to the merchant ID. Cyber security researcher Rajshekhar Rajaharia, who alerted MediaNama about the data leak, says that the seller on darkweb has been active since January 1st or 2nd and is asking for $8,000 in Bitcoins for the complete database. "The seller says that the data is in two-files, one is with 100 million details of customers and the second with 46 million transaction data," he said. According to Rajaharia,…
