UPSIDER: supply chain attack through open source software

A malicious open-source package compromised an UPSIDER developer device on March 24. It received a credential-leak notification on March 25 and invalidated those credentials; notification of a different leak on March 31 triggered emergency response. Protective shutdown stopped UPSIDER, PRESIDENT CARD and AI Keiri at 03:40 on April 1. Logins recovered at 10:57, card payments at 12:20, and all functions progressively by April 9. The security incident was disclosed April 10. Its June 12 final report found no traces of customer-data exfiltration and assessed leakage as very unlikely.