I’LL: CROSS POINT API-key abuse exposes one client’s member information

Early on 7 November, I’LL confirmed that a legitimate API key assigned to one CROSS POINT client had escaped externally and was used to retrieve member information. It says this was not direct intrusion into the internal database, tampering, or exploitation of a program vulnerability. The client, affected count and key-exposure route are not disclosed. [1]

Potential fields include names, birth dates, gender, postal/contact details, member IDs/ranks, points, store-card and e-commerce account IDs, and purchase statistics. Card details and login passwords are not held. The affected key was revoked/reissued and source access blocked; safeguards including rotation of all clients’ keys were completed at 22:15 on 9 November. No evidence of exposure at other clients is confirmed. [1]