Unencrypted Data Lets Thieves ‘Charge Anywhere’
Summary: Charge Anywhere LLC, a South Plainfield, N.J. mobile payments provider, disclosed that malware planted on its networks may have exposed credit card data from transactions it handled between November 2009 and September 2014, including customer name, card number, expiration date and verification code. The company said the intruder installed malware to capture outbound network traffic, and that although much of that traffic was encrypted, the format and method of connection for certain outbound messages let the attacker capture plain text payment card transaction authorization requests.
Key Takeaway: The company believes only traffic captured from August 17, 2014 through September 24, 2014 was identified, yet it allowed that the intruder had the ability to capture network traffic as early as November 5, 2009 - a five-year window in which card data moved across its network in plain text.
Read the original at Krebs on Security ↗
- Topics
- Data Breaches
- Related
- TSMC employee data breach linked to cloud provider Cyber Risks · Nov 15, 2026Data Breach at La Poste Subsidiary Maileva Affects 22 Million People in France Cyber Risks · Nov 15, 2026City of Osaka warns of data breach impacting 1 million as Japan reels from dozens of cyber incidents Cyber Risks · Nov 13, 2026