Edion Says Malicious Code Leaked Card Numbers and CVV Codes

What may have been exposed

The rogue program was built into the PC payment-entry process and had been running since just after 7 p.m. on November 4. Smartphone operations and payment entry were not targeted. The figure of 556 is the maximum number of times new card details were entered on the payment screen. The data includes card number, expiry date, cardholder name and security code.

Separately, when errors occurred on the order screen, card numbers and security codes were exceptionally recorded in the system log. Up to five such records may have leaked, again including expiry date and cardholder name.

The investigation also widened the scope of the original breach. Up to 5,360 Edion gift card records (card number, PIN and usage history) and up to 1,141 login IDs and passwords may also be affected. Edion plans to email affected customers to ask them to change their passwords, and is still deciding how to handle the gift cards.

Background and next steps

The first report said an external attacker exploited a system vulnerability to reach part of a server area holding the e-commerce site's log files. Personal data on up to 4,131 people and order information on up to 9,554 people may have leaked.

To prevent further damage, Edion suspended its e-commerce site, official app and Smart App from 10 p.m. on November 7. No date has been set for the e-commerce site to reopen.