Fivot: unauthorized access to the IDARE cashless payment service

Fivot, which runs the IDARE prepaid cashless service, said attackers exploited a vulnerability in third-party software it used for customer support and other work, and took data from its database several times between 10 August and 27 September. All 129,659 people who registered by 27 September, including those who left, are affected: phone numbers, emails, birth dates, balances, transaction histories and card names and expiry dates leaked. For some, names, addresses, genders, ID document numbers and parts of card and bank account numbers leaked too. Passwords and ID document images were not included. Fivot stopped using the software and renewed credentials. The October 21 second report said no unauthorized transactions had been confirmed; independent investigation results were expected around late November to early December.