JP — ITmedia

GMO Payment Gateway reports "unauthorized user activity" in payment support system; 69 Vpreca records leaked, 3 including security codes

SecurityNovember 4, 20261 min read

GMO Payment Gateway, a payment company in the GMO Group, said that an unauthorized user caused a data leak. About 69 customer records from Life Card's Visa prepaid card "V Prepaid" were exposed.

What happened

On October 30, GMO Payment Gateway's card-issuing support service was hit by an "unauthorized user action." The service helps credit card companies issue cards and process transactions. Customer data for Life Card's V Prepaid card leaked. The company announced this on November 2. Life Card has not seen any misuse of the most sensitive cases. It cancelled those cards on October 31. Both companies have paused part of the service while they add protections and check safety.

Key numbers

69 records leaked in total
63 records: name, email, phone number, and part of the address
3 records: full card number (16 digits), security code, expiry date, and name
3 records: only part of the card number
Only the V Prepaid feature for Life Card was affected. Other customers were not affected, the company says.

Background

V Prepaid is a prepaid Visa card. You charge it with money first, and you can use it for online shopping even if you do not have a credit card. GMO Payment Gateway runs the back-end system that makes this card work. Each company runs its systems separately, so the company says the leak stayed within this one feature.

Why it matters

Card numbers and security codes are the keys people use to pay online. If someone gets them, they could make fraudulent purchases. Life Card will contact the people affected one by one. This case also shows how one company's outside system can put many customers at risk.

What to watch

Whether Life Card confirms any misuse of the 3 full-card records
When Life Card restarts the V Prepaid service after safety checks
Whether the companies find out how the unauthorized user got in
Any new notices to affected customers

Researchers warned of North Korean hacking tactics years before record $6.3B Binance heist

Binance says North Korean hackers posed as recruiters and used a fake coding assignment over a months-long scheme to install malware on a software engineer's work laptop, which gave them a foothold to steal a record $6.3 billion in crypto. The company said its security tools did not detect the malware and that it has since improved its network security. Researchers and governments had warned for years about North Korean social engineering tactics targeting the crypto industry.

SecurityTechCrunchNov 4

CrowdStrike to shell out nearly $500M for 2 AI security startups as the market for securing agents takes off

CrowdStrike is buying AI security startups Fiddler AI, which makes observability software for monitoring AI agents, and Dreadnode, which automates security testing for AI models, apps and agents. According to The Wall Street Journal, the company is paying about $400 million for Fiddler AI and about $95 million for Dreadnode. Fiddler AI will become part of CrowdStrike's Falcon platform as Falcon Observe, and Dreadnode will be integrated into its Falcon Guardian product.

SecurityArs TechnicaNov 4

Google dismantles botnet secretly running on 1.3 million Android TV boxes

Google's Threat Intelligence Group says it has shut down the x.cpe botnet, which at its peak ran on more than 1.3 million Google-certified Android TV devices, mostly sold under the MECOOL brand. The malware evaded Google's screening through obfuscation and was installed remotely via a backdoor after devices went online, with the botnet's operator, Shenzhen-based Videostrong Technology, selling access to third parties. Most infected boxes were used for residential proxy traffic or ad fraud.

SecurityThe RegisterNov 4

Password manager mSecure tells users to change passwords, won't say why

Password manager mSecure has told customers to change their passwords, reset two-factor authentication, and possibly remove passkeys after detecting suspicious activity. The developer, mSeven Software, has not said what happened, when it occurred, or whether customer information was accessed. Customers on the company's support forum have demanded details, and mSeven has not yet responded to The Register's questions.