VALTEC: unauthorized access; customer data may have leaked

On 22 October, VALTEC, which provides ICT services to businesses, said unauthorized access had led to what counts as a customer data leak, and stopped many services, including attendance, expense, web booking and POS systems. Its first notice blamed an attack targeting a PHP vulnerability, but it corrected this the same day, saying a vulnerability in its own service was exploited. The scope is under investigation, and it expects recovery on 26 October at the earliest. Its second report on October 23 said malware had been planted inside a server through unauthorized access on October 20. Names, phone numbers, email addresses and other customer data in many services, including POS, attendance and web booking, may have leaked, though no leak has been confirmed. Its third report on 26 October said the attacker exploited a service vulnerability and sent data out: company details of 1,213 contract holders and sales data of 875 companies. For FreePOS, BeSHOKU, BeSALO and ticket machines this covers login IDs, passwords, names, phone numbers, email addresses and sales data; for MOT/HG, MOT/Cloud, expense and attendance services, names, phone numbers and email addresses. Counts are under investigation. Services are resuming on new servers from 26 October, and all passwords have been reset.