7-Eleven, the Japanese-American international chain of convenience stores, had terminated its '7pay' mobile payment system after customers reported losses of hundreds of thousands of dollars.
The app allowed users to purchase items without NFC at roughly 21,000 7-Eleven stores in Japan.
What they need to do, was to just sign in into their accounts, show a barcode to the cashier, and make the purchase charged to their preferred payment method, including credit or debit card.
However, a severe security flaw on the system allowed the password reset function to send emails to third-party addresses. Here, hackers only needed to know the targets' user email, date of birth, and phone number to obtain full access to the account.
Due to previous data breaches that happened in Japan, hackers have found it easy to get the required information. Furthermore, with almost everyone using social media, such sensitive information is often exposed to public, making things even easier.
And what make matters worse is that, the date of birth information wasn't even required in some cases.
This is because the app automatically set it to January 1st, 2019, whenever the owner didn't provide any birthday details.
Hackers that managed to discover this severe security flaw, were able to make over ¥55 million ($510,000) from illegal charges. The hackers appeared to have used automated attacks to hack around 900 7pay users in a single day attack.
The company first realized about this issue on July 2nd, after receiving customer complaints. The next day, on July 3rd, 7-Eleven effectively deactivated the service, only two days after its initial launch.
According to the website for 7pay:
This incident marks a setback for digital payments in Japan, which ranks lower than its Asian peers in the rate of cashless transactions.
A member of Japan’s Ministry of Economy, Trade and Industry has determined the operator, Seven & I Holdings Co, to fail in strictly following guidelines to prevent unauthorized access. The Ministry judged that Seven & I did not take sufficient measures to prevent access by people using someone else’s ID.
The guidelines referred by the Ministry, were created by the Payments Japan Association, a body that promotes cashless transactions. The guidelines require operators of mobile payment services to confirm the linkage between the devices of users and apps downloaded on them to prevent unauthorized access.
The Ministry urged the company to boost its security measures if it wants to re-launch 7pay in the future.
Following investigations have since arrested Zhang Sheng and Wang Yunfei. The two Chinese were attempting to use the hacked accounts for purchases amounting to thousands of dollars with the app.
One of two men were arrested on suspicion of attempted fraud paid ¥730,000 ($6,750) to buy 146 cartons of electronic cigarette cartridges at a 7-Eleven outlet in Shinjuku Ward using stolen IDs, the police said. The vehicle used by the pair, had 19 more cartons of e-cigarettes.
The two Chinese men said that they had received instructions from a person who promised them a reward, according to the police.
The authorities believe that they are connected to a Chinese crime ring known for utilizing stolen identities.
