Chariloto: unauthorized access to the Chariloto keirin and auto race betting app

On 24 October Chariloto, which runs the Chariloto betting service for keirin and auto racing, said a vulnerability in its app system had been exploited and member data taken by a third party. The access ran from about 09:30 to 13:00 on 21 October; suspicious logs found in a check on 22 October led it to stop the app, which reopened on 23 October after a fix. 373 Charica members are affected: member data such as names, birth dates, gender, addresses, phone numbers and email addresses, bank account details, card holder name, last four digits, expiry and brand, balance and deposit and withdrawal history, and betting history. Login passwords, full card numbers and security codes were not included. No misuse has been confirmed, and the company reported the case to the Personal Information Protection Commission.