Retail News CRM

Tag: data breach

  • Doctor Anywhere Suffers Data Breach Exposing Identification and Bank Records

    Doctor Anywhere Suffers Data Breach Exposing Identification and Bank Records

    Telehealth provider Doctor Anywhere announced on Friday evening, Nov 6, that an unauthorized third party breached its systems and accessed users’ personal information.

    The intrusion, which the Singapore firm discovered on Oct 29, compromised customer names, email addresses, dates of birth, emergency contacts, bank account numbers, identity card digits and passport details.

    Doctor Anywhere stated that investigations have found no evidence showing passwords, account login credentials, payment card details or scanned identity card photos were compromised, though it has not disclosed how many users were affected.

    Corporate Benefits Exposure Through Adept Health

    Part of the compromised data involves corporate accounts held through Adept Health, a Doctor Anywhere subsidiary that manages employee benefits programs for corporate clients across Singapore. The platform keeps select personal records of corporate members inside its central architecture to administer employer coverage and process claims.

    Digital health providers across Southeast Asia rely on corporate medical coverage contracts to generate recurring cash flow alongside direct-to-consumer video doctor consultations. A breach across employer benefits architecture creates immediate legal and compliance questions for human resource directors managing corporate health data.

    Fixes Deployed with Ensign InfoSecurity

    The company engaged cybersecurity and digital forensics firm Ensign InfoSecurity to examine the network intrusion and apply corrective patches. Ensign confirmed that the discovered vulnerabilities were locked down and validated the fixes on Oct 30, according to the health operator.

    Medical treatment records remained untouched throughout the incident, the provider said following initial network scans. Its digital platform, outpatient clinics and walk-in facilities remain fully operational while customer notifications continue.

    Regulatory Reports and System Review

    Doctor Anywhere reported the breach to the Personal Data Protection Commission and lodged a formal report with the Singapore Police Force. The healthcare group must now handle regulatory inquiries under local personal data protection laws while notifying affected corporate accounts and private users.

    Telehealth and app-based clinic operators throughout the region face tighter scrutiny over data boundaries as medical services merge with insurance administration and electronic payment processing. Doctor Anywhere faces the immediate task of satisfying corporate clients on data segregation while keeping core clinic visits running on schedule.

  • Salesforce Finds No Vulnerability in AU Small Finance Bank Leak

    Salesforce Finds No Vulnerability in AU Small Finance Bank Leak

    Salesforce found no platform security vulnerabilities following a suspected customer data leak at India’s AU Small Finance Bank, the enterprise software company said on Saturday.

    AU Small Finance Bank opened an internal inquiry after extortion outfit ScarlettGroup claimed on Thursday to possess vehicle loan files hosted on external software.

    The lender confirmed that core banking infrastructure remains unaffected, isolating the inquiry to third-party software while branch operations continue normally across the domestic network.

    Disputed Access to Vehicle Loan Records

    Threat intelligence platform Hackmanac reported that ScarlettGroup threatened to leak sensitive records taken from the bank’s perimeter. The claimed haul covers customer identity paperwork including PAN and Aadhaar records, signed loan contracts, credit bureau evaluations, bank statements, and staff credentials.

    Salesforce maintains that the software platform itself shows no technical failure. The company stated that it does not discuss individual client deployments as a matter of policy, though technical teams are assisting the lender during the review.

    Verification of the stolen dataset remains unresolved. Threat actors frequently publicise sample files to force negotiations before corporate defenders assess whether the exposed folders came from active systems, older backups, or third-party brokers.

    Consumer Credit Exposure

    Vehicle financing represents one of the most document-heavy consumer lending categories in India. Lenders assemble physical identity proof, income validation, and collateral records for every vehicle financed on the road.

    A confirmed release of identity documents creates direct exposure for borrowers through identity fraud and fake account openings. For consumer retail finance desks, third-party software integrations represent an operational weak point because corporate security teams hold less visibility over vendor-managed environments.

    Lenders across the market increasingly deploy third-party cloud tools to speed up credit checks and field sales. That architectural shift cuts credit approval times at car dealerships, but it scatters applicant personal data beyond internal bank servers.

    Institutional Warning Over Financial Threats

    Indian authorities have stepped up scrutiny on digital finance infrastructure following recent breach reports across major retail lenders. Commercial institutions including State Bank of India and ICICI Bank faced suspected digital incidents during recent security reviews.

    Prime Minister Narendra Modi addressed the exposure on October 25, warning that cyber intrusions target financial system stability. The warning came during the launch of the Reserve Bank of India’s Rs 169-crore data facility and cybersecurity institute in Bhubaneswar.

    The central bank has pushed commercial lenders to run frequent perimeter tests and review vendor risk governance. Bank boards face stricter compliance requirements when consumer identity documents sit on hosted third-party services.

    Outstanding Verification by Security Teams

    Investigators from AU Small Finance Bank and external response teams continue examining server logs to establish how files were pulled from the system. The scope of customer accounts exposed during the incident remains unconfirmed by the lender.

  • Park24 to Pay ¥3,000 to 1.46 Million Car-Share Breach Victims

    Park24 to Pay ¥3,000 to 1.46 Million Car-Share Breach Victims

    Tokyo-listed parking and mobility operator Park24 will pay ¥3,000 in cash or gift cards to 1.46 million car-sharing customers whose personal identification records were compromised in a cyberattack.

    The payouts will cost approximately ¥4.4 billion, forcing the operator to book an extraordinary loss of ¥5.5 billion for its fiscal year ending October 2026.

    Total unauthorized access hit 6.62 million user accounts on the group’s flagship Times Car network. Park24 confirmed that external actors extracted stored identification images, including driver’s licenses, from 1.46 million of those profiles. The company maintains that the files were encrypted and were not immediately readable at the point of extraction, pledging to review individual cases if verified financial damage emerges.

    The Cost of Driver Verification Failures

    Park24 restricted the ¥3,000 consolation sum strictly to the subset of members whose scanned identification documents were transferred outside its servers. The remaining 5.16 million affected account holders will receive no direct payout under the present scheme.

    For Japanese app-based mobility providers, digital know-your-customer data forms the core operational bottleneck. Fleet operators require high-resolution driver’s license scans to validate bookings and satisfy Japanese transport regulations. When those image repositories leak, consumers face identity theft risks that basic password resets cannot address.

    Settling customer goodwill for roughly $19 per compromised identity card represents a defensive maneuver. The flat payment aims to head off churn across urban hubs where Times Car competes against railway operators and leasing conglomerates for shared-fleet market share.

    Mounting Class Action Resistance

    Consumer acquiescence is far from guaranteed. Tokyo-based Makino Law Office confirmed plans to organize affected Times Car drivers and file a joint damages lawsuit against the mobility operator.

    Attorney Yuki Makino characterized the compensation plan as inadequate for the long-term administrative burden imposed on drivers. More than 90,000 vehicle-sharing members have already enrolled online to join the collective legal action.

    The legal push challenges the standard Japanese corporate playbook of issuing small fixed-value gift vouchers after systemic cybersecurity failures. If the lawsuit secures broader certification or forces higher restitution tiers, legal liabilities will spill over into the group’s 2027 accounts.

    Prior Intrusions Across Consumer Networks

    The incident traces back to September 2026, when security teams at Park24 initially spotted unauthorized access within Times Car network infrastructure.

    Corporate Japan has faced an intense run of consumer-facing breaches throughout 2026. Official tallies recorded over 19,000 personal data breaches nationwide during fiscal 2025, prompting trade bodies and digital agencies to tighten oversight rules.

    Park24 now enters its next financial reporting cycle with an open legal docket, as Makino Law Office prepares its court filings against the car-sharing operator.

  • Data Breaches Hit 16% of Japanese Companies in Teikoku Survey

    Data Breaches Hit 16% of Japanese Companies in Teikoku Survey

    More than 16 per cent of Japanese companies suffered or suspected data breaches from cyberattacks and staff mistakes, according to research by Teikoku Databank.

    Large enterprises took the heaviest blow, with 30.2 per cent reporting actual or potential incidents compared to 14.3 per cent among smaller businesses.

    Breakdown of Enterprise Exposure

    The survey gathered responses from 1,328 companies across Japan between October 4 and October 14. Human error accounted for a substantial share of exposure, led by misdirected outbound emails and staff answering spoof messages from impostors posing as commercial clients.

    Another 14.8 per cent of respondents stated they did not know whether a breach had taken place at all. That knowledge deficit points to undetected intrusions across corporate networks where monitoring tools remain thin.

    The Supply Chain Vulnerability

    Large corporations in Japan face immediate exposure through their downstream commercial networks. While major operators invest in defensive software, their reliance on smaller suppliers creates entry points that bypass perimeter controls.

    Tier-two and tier-three vendors handle billing details, inventory files, and customer records without equivalent safeguards. When large buyers demand stricter security compliance, smaller contractors often lack the budget to implement required protocols.

    Funding and Personnel Gaps

    Small enterprises struggle to compete for specialized IT workers and allocate capital for cybersecurity overhauls. Upgrading data infrastructure requires dedicated hardware and ongoing monitoring contracts that squeeze thin operating margins.

    Many smaller suppliers report receiving direct mandates from key corporate clients to upgrade defensive protocols. Without financial subsidies or direct technical assistance from those buyers, smaller firms remain unable to fill basic staffing gaps.

    Corporate Defense Pressures

    Japanese commercial groups have tightened vendor audit rules following repeated unauthorized access disclosures across consumer and corporate databases. Regulators have pressed firms to identify third-party vulnerabilities faster.

    Enterprise buyers now weigh whether to subsidize technical support for their vendor rosters or drop non-compliant suppliers before the next reporting cycle begins.

  • AI Tools Used in Cyberattacks on South Korean Banks

    AI Tools Used in Cyberattacks on South Korean Banks

    Hackers used artificial intelligence agents to breach at least nine South Korean financial institutions in October 2026. The attack compromised personal data from more than 25,000 banking customers.

    Major domestic lenders bore the brunt of the intrusions. Shinhan Bank reported 25,000 compromised customer records, while KB Kookmin Bank confirmed 119 leaked customer profiles.

    Automated Penetration Tools In Action

    Running from late September to early October, the campaign relied on an open-source security tool named ARTEX paired with Anthropic’s Claude Code. A Chinese security researcher using the alias Autumn published ARTEX on GitHub earlier this year. The software functions as an automated penetration agent. It links directly into external large language models including ChatGPT, Claude and DeepSeek to run vulnerability tests across target servers.

    The software repository explicitly restricts use to local testing and research. Even so, the attacker weaponised the framework against live online banking infrastructure. Cybersecurity firm CrowdStrike tracked the interactive sessions. The firm found that the operator fed target environments directly into AI coding interfaces to accelerate intrusion paths and system mapping.

    Traces Left In Model Prompts

    During the operation, the operative inadvertently leaked personal information directly into model prompt logs. Session records show queries asking where threat actors sell compromised Korean databases and requesting specific Korean data-trading channels on Telegram. In a separate prompt, the attacker instructed Claude to compile a curriculum vitae. That document contained a personal Telegram handle, educational background, age and an address in Maoming, Guangdong province.

    Digital infrastructure and Chinese-language prompts pointed investigators toward a 26-year-old individual operating out of southern China. “While this activity has not been attributed to a named adversary, the threat actor is likely a Chinese speaker and financially motivated,” CrowdStrike stated in its findings.

    Operational Risks For Retail Banking

    Automated AI penetration shifts the economics of perimeter defense for financial institutions and retail digital banking platforms across the Asia-Pacific region. Attackers no longer need deep bespoke code writing. Open-source agents can autonomously test attack surfaces and parse enterprise firewalls around the clock at negligible cost. Traditional web application filters now face automated scanning that iterates faster than standard manual patch schedules.

    Commercial banks face compounding costs from consumer notification mandates, regulatory fines and identity theft remediation. Containment protocols must now focus on rapid API throttling and continuous identity verification rather than static perimeter defenses. Retail platforms managing high volumes of consumer payments and stored credentials represent immediate targets as autonomous agent frameworks lower execution barriers.

    Escalating AI Incursions In Asia-Pacific

    Earlier incursions set the stage. In June, an autonomous AI agent breached a government health portal in Australia in one of the region’s earliest documented cases of autonomous agent exploitation. Financial regulators in Japan and South Korea had heightened network surveillance earlier this year as code-generation tools expanded the volume of automated attack scripts circulating in private forums.

    Police in South Korea opened a formal criminal investigation into the nine targeted institutions this week following directives from President Lee Jae Myung for immediate security interventions. Regulatory authorities in Seoul are auditing network logs across commercial lenders to determine if secondary data exfiltration occurred before defensive patches took effect.

  • Oz Hair and Beauty Discloses Customer Data Breach Across Order Platform

    Oz Hair and Beauty Discloses Customer Data Breach Across Order Platform

    Oz Hair and Beauty has suffered a cyber incident on its online purchasing platform. The breach exposed the personal details and transaction histories of customers who placed orders before August.

    An unauthorised third party gained brief access to data managed through an external service provider. The Australian e-commerce merchant disclosed the incident to shoppers in a direct notification.

    Exposed records include full names, email addresses, mobile numbers, and purchase details showing total spend, currency, city, state, and postcode. Attackers did not obtain passwords, credit card numbers, payment details, or street addresses, the company stated.

    Third-Party Platform Compromise

    External technical specialists launched an investigation immediately after staff detected the intrusion. Early findings point to data held by a contractor rather than a direct breach of internal systems.

    Oz Hair and Beauty has not disclosed the total number of affected customer accounts. It reported the incident to the Australian Cyber Security Centre and the Office of the Australian Information Commissioner while notifying affected buyers.

    Earlier this month, a separate cyber attack hit furniture retailer Nick Scali and forced core IT infrastructure offline across its regional business. Australian consumer brands face tightening scrutiny over vendor data storage as regulators press merchants to shorten retention schedules.

    Security Audit Underway

    The beauty retailer is now overhauling its data protection controls and third-party storage policies to prevent repeat exposures across its digital channels.

    Technical investigators are still determining the full timeline of the intrusion. The retailer has yet to submit its final incident report to federal privacy regulators.

  • Coupang Data Breach: Unmasked Details of 33 Million Customers Sparks Privacy Fears

    Coupang Data Breach: Unmasked Details of 33 Million Customers Sparks Privacy Fears

    Increased apprehension has gripped South Korea following a significant data leak at e-commerce giant, Coupang. Officials have indicated that this breach could have been overlooked for an extended period.

    Scale of Data Leakage

    Coupang, a United States-listed merchant, revealed on a recent Saturday that the private information of 33.7 million consumers, essentially its entire client base, had been jeopardized. The vulnerable data encompass names, contact numbers, email addresses, and delivery locations. The company reassured that financial information, credit card specifics, and login details remained untouched.

    Based on Coupang’s findings, unauthorized infiltration into the delivery-related private data seems to have been carried out via foreign servers from June 24 onwards.

    Investigation Update

    Individuals familiar with the situation have shared that the police have pinpointed at least one suspect. The person is allegedly a former Chinese worker of Coupang who has since dissociated from both the company and the nation. The authorities initiated an inquiry after receiving a complaint.

    Coupang confirmed detecting the data leak on November 18 and informed the regulators within the subsequent two days. The corporation initially stated that approximately 4,500 accounts had been impacted.

    Implications of the Breach

    The magnitude of the data exposure, which is now proven to be considerably more extensive and long-standing than initially conveyed, has unsettled consumers. They are apprehensive that their data might be exploited for fraudulent activities or phishing strategies. The event now surpasses the cyber breach at SK Telecom in April, which affected data from 23.2 million users and led to a record penalty of 134.8 billion won.

    The final repercussions could escalate as the investigation progresses. A similar recent incident involving Lotte Card initially denied leakage of financial data following a breach in September. The company had to backtrack two weeks later and admit that credit card numbers and other critical data had indeed been laid bare.

    Questions & Answers

    What type of data has been compromised in the breach at Coupang?
    Names, phone numbers, email addresses, and delivery locations of customers have been exposed.

    Who has been identified as a possible suspect in this data breach incident?
    The police have identified a former Chinese worker of Coupang as a possible suspect.

    What are the possible implications of the data breach at Coupang?
    This breach has unsettled consumers who fear their personal data might be exploited for fraudulent purposes or phishing schemes. There is also a possibility of monetary penalties for the company.

  • Qantas Faces Cyberattack: Personal Data of Six Million Customers Breached in Major Security Incident

    Qantas Faces Cyberattack: Personal Data of Six Million Customers Breached in Major Security Incident

    In an alarming development, Australian airline Qantas has confirmed a significant data breach that has jeopardized the personal information of up to six million customers. This breach came to light following a cyberattack on a third-party customer service platform linked to a call center based in Manila, Philippines.

    A Shocking Vishing Attack

    The cyber intrusion, detected on June 30, involved a sophisticated form of voice phishing known as vishing, where malicious actors masquerade as trusted entities over phone calls to extract sensitive information from unsuspecting victims.

    Exposed Information and Assurances

    The compromised customer service platform housed a trove of personal data, including customers’ names, email addresses, phone numbers, birthdates, and frequent flyer numbers. However, Qantas has reassured customers that no financial information, credit card details, or passports were stored within the affected system. Additionally, the integrity of frequent flyer account credentials, passwords, and PINs remains intact.

    Robust Response and Investigation

    Operations and flight safety have not been compromised, as the airline emphasized. In response to this breach, Qantas has notified Australian intelligence agencies, including the Australian Cyber Security Centre, and law enforcement agencies such as the Australian Federal Police. The Office of the Australian Information Commissioner has also been apprised of the situation.

    To bolster customer assurance, the airline has initiated a comprehensive investigation and established a dedicated support line and website to keep affected customers updated. Those impacted will receive direct communication from the company.

    A Heartfelt Apology

    Qantas Group CEO Vanessa Hudson publicly addressed the situation, offering an apology to customers. “Our customers trust us with their personal information, and we take that responsibility seriously. We are contacting them directly and offering necessary support,” Hudson stated. It’s clear that trust, once broken, can be harder to mend than a wing on a seasoned aircraft.

    Questions & Answers

    What was the cause of the Qantas data breach?
    The breach stemmed from a cyberattack on a third-party customer service platform in the Philippines, involving a voice phishing scheme known as vishing.

    What type of personal information was compromised in the breach?
    The exposed information included customers’ names, emails, phone numbers, birthdates, and frequent flyer numbers, but no financial data or passwords were at risk.

    How is Qantas responding to the breach?
    Qantas has launched a full investigation and established a support line for customers while notifying relevant authorities and directly contacting affected individuals.

  • McDonald’s Korea fined for breach of customers’ personal data

    McDonald’s Korea fined for breach of customers’ personal data

    McDonald’s Korea was given a fine of 696 million won ($532,110) on Wednesday after the personal data of 4.87 million customers was leaked to hackers due to the firm’s lax data management.

    The Personal Information Protection Commission handed out the fine to the Korean branch of the American fast food chain, along with a financial penalty of about 10 million won for the data breach.

    According to the commission’s findings, McDonald’s Korea did not perform sufficient access control, leaving a backup file containing the personal data of its restaurant and McDelivery customers accessible via protocols for file sharing.

    As a result, the personal data of more than 4.87 million customers was hacked and leaked. McDonald’s Korea was also found to have not destroyed the personal data of 766,846 customers for whom the data retention period had expired, and belatedly notified authorities and customers of the data leakage.

    Lees ook:

  • Facebook in legal battle with Australia over alleged user data breach

    Facebook in legal battle with Australia over alleged user data breach

    Last year, Facebook received a penalty of $5 billion by the American Federal Trade Commission for sharing personal information via a survey product called “This Is Your Digital Life”, which disclosed users’ Facebook data to a political consultant Cambridge Analytica. Now, an Australian privacy regulator is filing a lawsuit against the tech giant over the same survey, which this time is said to have shared the data of more than 300,000 Australians.

    The lawsuit is filed in regards to 311,127 users’ personal data being unlawfully shared, with the users not being aware of their data’s disclosure. According to Reuters, the lawsuit didn’t request any specific amount in damages, however, each breach of the privacy law can amount to around $1.1 million penalties at most. So in total, if each of the 311,127 instances is taken into consideration, the penalty facing Facebook could be up to a maximum $348 billion.

    The disclosed personal information could be used for monetization and political purposes and is considered a serious interference with the privacy of Australian individuals. However, Facebook did not provide any comment on the issue.

    Overall, until now, allegedly Facebook has unwillingly shared information of over 87 billion users via the aforementioned survey tool. According to the Australian lawsuit, Facebook was not aware of what data it shared with the program, but this is still considered a failure to protect user data.

  • Forever 21 investigating POS security breach

    Forever 21 investigating POS security breach

    A Forever 21 data breach uncovered last November has prompted the fashion retailer to boost security at its checkout counters.

    In the security scare, hackers installed malware on point-of-sale machines at store checkouts in the US.

    A two-month long investigation has revealed that encryption technology on some POS devices at an unspecified number of stores was not always on and that malware had been installed by criminals looking to mine the system for customer payment data.

    The breaches occurred between April 3 and November 18 last year, lasting between a few days and in some cases the entire period, the company has admitted. Forever 21 stores use multiple POS devices and in most cases only one or a few of the POS devices in a store were affected.

    The malware searched for data on cards used for payments at the point-of-sale. In most cases, the data did not include the cardholder’s name, so was of no use to the hackers, but in a minority of instances, the cardholder’s name was found.

    Forever 21 said it has been working with its payment processors, hardware suppliers and independent consultants to improve the encryption systems on the POS devices in all Forever 21 stores.

    “We also continue to work with the payment card networks so that the banks that issue payment cards can be made aware of this incident,” the company said in a statement. “Lastly, we will continue to support law enforcement’s investigation of this incident.”

  • Massive data breach exposes all Philippines voters

    Massive data breach exposes all Philippines voters

    The Philippines’ 55 million voters are now susceptible to fraud and other risks after a massive data breach leaked the entire database of the Commission on Elections (Comelec), security firm Trend Micro has warned.

    The defacement of the Comelec website by a hacker group called Anonymous Philippines happened at near midnight on March 27. In a message to the government, the group said they want the poll body to implement tighter security measures on the precinct count optical scan (PCOS) machines to be used in the May 9 polls.

    “But what happens when the electoral process is mired with questions and controversies? Can the government still guarantee that the sovereignty of the people is upheld?” the hackers posted in the defaced Comelec website.

    A report said a second hacker group called LulzSec Pilipinas posted within day an online link to the Comelec’s whole database. The following day, the group also reportedly updated the post to add three mirror links to an index of files that could be downloaded.

    Trend Micro said the leak may turn out as the biggest government-related data breach in history, surpassing the Office of Personnel Management (OPM) hack in 2015 that leaked personally identifiable information (PII), including fingerprints and social security numbers (SSN) of 20 million US citizens.

    While the Comelec has given assurances to the public the day after the hacks that the no sensitive information was compromised and the country’s second automated polls will be secure, the securty firm believes otherwise.

    “Based on our investigation, the data dumps include 1.3 million records of overseas Filipino voters, which included passport numbers and expiry dates. What is alarming is that this crucial data is just in plain text and accessible to everyone,” the security firm said in a blog post.

    “Interestingly, we also found a whopping 15.8 million record of fingerprints and a list of people running for office since the 2010 elections,’” it added.

    “Among the data leaked were files on all candidates running on the election with the filename VOTESOBTAINED. Based on the filename, it reflects the number of votes obtained by the candidate. Currently, all VOTESOBTAINED file are set to have NULL as figure.”

    Regardless whether the hacking could affect the elections, the security firm said there is still the issue of all voter information that was leaked.

    Lees ook:

    Lees ook:

    Lees ook:

    Lees ook: