PayHere data breach: 1.6M accounts exposed
Severity: high · Patch status: no-fix-needed · Since 2022-05-02
In late March 2022, the Sri Lankan payment gateway PayHere suffered a data breach that exposed more than 65GB of payment records including over 1.5M unique email addresses. The data also included IP and physical addresses, names, phone numbers, purchase histories and partially obfuscated credit card data (card type, first 6 and last 4 digits plus expiry date). A month later, PayHere published a blog on the incident titled Ensuring Integrity on PayHere Cybersecurity Incident. Exposed data: email addresses, ip addresses, names, partial credit card data, phone numbers, physical addresses, purchases. The breach dates from Mar 27, 2022; Have I Been Pwned loaded it on May 2, 2022.
What to do
- If you had a PayHere account, change its password and the password of any other account that reused it.
- Turn on multi-factor authentication wherever it is offered.
- Check whether your addresses are in this breach at https://haveibeenpwned.com.
- Expect targeted phishing that quotes the leaked details; verify any unexpected contact out of band.
Sources
All live incidents on Threat Watch
