GMO Payment Gateway said on November 2 that "acts by an unauthorized user" on October 30 in the issuing support service it provides to card companies and others leaked the user information of 69 people holding V Prepaid, Life Card's Visa prepaid card.
In three of those cases, a 16-digit V Prepaid number — the equivalent of a credit card number — may have been taken together with its dedicated security code, expiry date and the holder's name. Life Card said it has confirmed no fraudulent use of the three and closed the accounts on October 31.
The rest of the leaked data falls into two groups: 63 sets of name, email address, phone number and part of a postal address, and three partial V Prepaid numbers. A security code stored alongside a card number is enough to make online purchases, which is why its exposure matters more than the count suggests.
What was exposed
- 3 records: V Prepaid number (16 digits), dedicated security code, expiry date and name
- 63 records: name, email address, phone number and part of a postal address
- 3 records: part of a V Prepaid number
V Prepaid is a top-up Visa prepaid card that can be used for online shopping and similar payments without a credit card. GMO Payment Gateway's issuing support service supplies card issuance and transaction processing functions to businesses through an API.
Contained to one system, company says
The breach hit a function provided specifically for Life Card's V Prepaid, which runs on a different system foundation from the services GMO Payment Gateway provides to other customers, the company said. There is no impact on other customers, according to the company.
Payment processing and the company's other services also run on separate system foundations and are unaffected, it said.
Life Card will contact the affected holders individually. The two companies have suspended part of the affected service while they work on countermeasures and verify that it is safe, and Life Card plans to announce when the service resumes once that check is complete.