Mobile payments have become a hot topic of late, with the arrival of Apple Pay last Fall and the more recent launches of Android Pay and Samsung Pay in the last couple of months, more and more manufacturers are continuing to make their upcoming devices compatible with these services. A common concern for many individuals understandably falls under the security of mobile payments and whether or not attackers might be able to easily gain access to personal and sensitive information through malicious acts. While for the most part these systems are secure and users should have no cause for worry, there’s always the chance that security and privacy could be at risk.
This is made evident by the past breach of LoopPay by a group of Chinese hackers known as the Codoso group, which reportedly had gained access to LoopPay’s network of computers. Details state the group had breached LoopPay’s systems as early as sometime in March of this year, which was months before the official integration of LoopPay’s technology and the announcement of Samsung Pay. Samsung had acquired LoopPay in February, not long before the breach took place, although LoopPay wasn’t aware of the hack until sometime in August. According to the report LoopPay states they believe the hackers were after the MST technology that LoopPay initially ran off of which is now being used for Samsung Pay as the main driving force behind its compatibility with so many retail outlets.
Samsung issued a statement after the hack was discovered saying that the breach in no way affected Samsung Pay, which is likely going to be one of the first concerns for users. According to Samsung Pay co-general manager Will Graylin, there was nothing that revealed the hackers had gained access to Samsung’s systems or users’ payment data as the belief is that only LoopPay’s corporate network had been breached, which is a completely separate system from the production system that takes care of payment information. This could very well be true, but five months is a long time to have access to a network. According to security experts and two people who are apparently familiar with the investigation, the Codoso group is known for breaching systems and setting up backdoors they can utilize much later after the initial breach. So while there is perhaps no cause for immediate concern, it still brings attention to the possibility of a potentially more serious result of these hacks.