Metaps Payment: a vulnerability in its payment center was exploited, information in the "token method" database likely leaked, and it stopped payment services

1. 2021-08-02

   The attacks began. Until January 25, 2022 they combined unauthorized login to an internal management system, SQL injection and installation of a backdoor. [3]

2. 2021-12-14

   A card company told it of concerns about fraudulent use at Event Pay. [1]

3. 2021-12-15

   An internal check found no problem, and it began considering measures including a third-party forensic investigation. [1]

4. 2021-12-16

   It stopped card payments within Event Pay. [1]

5. 2021-12-17

   A third-party forensic investigation began. The card company sent further information on concerns about fraudulent use. [1]

6. 2021-12-28

   From this day to January 5, 2022 it also stopped new card payments on three more sites besides Event Pay. [1]

7. 2021-12-29

   It alerted some merchants by email. [1]

8. 2022-01-21

   In the evening it confirmed an event that strengthened the concern about a leak. [1]

9. 2022-01-25

   It stopped the credit card "token method" entirely and announced the case. [1] [2]

10. 2022-02-08

    It received the final report of the forensic investigation. [3]

11. 2022-02-18

    It filed a damage report with the police. [3]

12. 2022-02-28

    It published the final report. [3] [4]

13. 2022-06-30

    The Ministry of Economy, Trade and Industry issued an improvement order under the Installment Sales Act. [5]

14. 2022-07-13

    The Personal Information Protection Commission gave guidance under the Act on the Protection of Personal Information. [6]

15. 2022-08-01

    It submitted a report of improvement measures to the Ministry of Economy, Trade and Industry and the Personal Information Protection Commission. Its president resigned and was replaced, and three directors returned part of their pay for three months. [7] [8]

A vulnerability that had lain hidden in an application in the payment center let attackers access some information in the "token method" database, and a leak is likely. The content and scale of the leaked data were under investigation. Payments of organizations and merchants that use its collection systems Kaihi Pay and Event Pay stopped. It planned to finish the forensic investigation in mid-February 2022. [1] [2]

The final report found that information leaked from three databases holding payment data. In the token-method database, 460,395 card numbers used between October 14, 2021 and January 25, 2022 (card number, expiry date, security code) may have leaked; it could not identify what actually leaked, so the maximum is the whole set. In a separate payment-data database, a total of 593 leaks were confirmed among about 2.4 million held card payment and other records. 38 merchant records leaked from the merchant database. [3] [4]

The order of the Ministry of Economy, Trade and Industry required the company to keep and operate the international card data standard PCI DSS, set up recurrence prevention measures, strengthen internal controls on systems and security, rebuild its operations to rule out acts such as tampering with reports submitted to the auditor, and clarify management responsibility. [5]

The guidance of the Personal Information Protection Commission pointed out that the company did not know where it handled personal data, that inventories and audits had been partly skipped, that its internal audit was not working and that it had not examined intrusion alerts enough. It asked the company to carry out inventories and audits, strengthen internal audit and carry out the recurrence prevention measures it had already made. [6]

In response to the administrative actions, it put the improvement measures for its systems and organization, based on the recommendations of a third-party committee, into a report and submitted it. At the same time it decided the president's resignation and a successor, and accepted three directors' offer to return part of their basic monthly pay for three months. [7] [8]