Valuedesign: unauthorized access to the Value Card house e-money service

At Valuedesign, which runs and maintains the servers of the Mos Card prepaid card for Mos Food Services, suspicious access and login attempts against the management system were detected from October 14 to 18. Unauthorized access with an external program stole the 16-digit card numbers, 6-digit PINs and balances of 1,133,070 Mos Cards, about 570,000 of them in circulation and about 560,000 not yet issued. Names, addresses, phone numbers and credit card data were not included. Mos Food Services forced a PIN change on the affected cards. On 23 October parent PayCloud Holdings also disclosed that the servers of Value Card, the house e-money issuing service Valuedesign provides to issuers, had been accessed without authorization. A web server vulnerability was exploited, and the leak of ID numbers, PINs and balances was confirmed on 19 October: 1,424,748 IDs, of which 569,224 were issued and 855,524 not yet issued. No personal data was included. The risk of misuse of issued IDs has been dealt with, and no actual losses have occurred.