Juspay Data Breach

[Sushubh]

Redirecting

Data Of 10 Cr Digital Payments Transactions Leaked After Attack On Juspay’s Server

this fucking company ends up in every app out there.

 

[shashankb]

I just used it yesterday.

 

[JB701]

The leaked payment information has been masked in places to reveal only partial copies of card numbers. While this reduces the possibilities of a financial scam, resourceful hackers could still use the information to launch phishing scams to induce victims to hand over their card information.

It is worth noting that the standards laid down in PCI DSS (Payment Card Industry Data Security Standard) have been followed by Juspay in storing users’ card information. However, Rajaharia felt that if the hacker can find out the algorithm used to generate the card fingerprint, then he will be able to decrypt the masked card number.

 

[Sushubh]

It's the company that fetches OTP and automated payments right? Or I am confusing with something else?

OK it's the same. Payment gateway. Grofers uses it.

 

[shashankb]

Now what he`s saying might be true , but no one will reveal it the card details have been hacked as the company`s value will drop. That can only be verified if someone goes into Dark Web and sees if the card details are also up for sale

I wonder when that another gateway called Razorpay will get breached

 

[vishalrao]

Oh great. Another day Another breach. This is also used by swiggy where I regularly make purchases with a CC

 

[Jay]

Most of the apps out there use their SDK. The OneCard app constantly pings api.juspay.in whenever you use it.

Does anyone know how these payment gateways work exactly? Do the banks transmit personal information like names, phone numbers and email addresses to the likes of juspay and razor pay if we don't voluntarily provide it?

If we make a transaction using only the card number, expiry and cvv, what all information do the gateways get?

 

[Adithya]

UPI makes a lot of sense now.

 

[manu1991]

Do any banks in india support generating virtual one time cards that get destroyed and regenerated after every transaction? That's what I always use on AliExpress

 

[Jay]

OK, so I just had a look at the sample files provided by the seller. There are two tables - one for stored cards and the other apparently the details of merchant accounts and their customer data.

The stored cards table has many vault poviders listed - I see entries for 'JUSPAY' and 'PAYU'. So many entries for 'olauser' as well. Basically if you have a card stored anywhere online in India, it'll likely be there.