The data leak in the Mastercard bonus program "Priceless Specials" has also affected complete card numbers. Mastercard told customers that "possibly" also affected their payment card number, with which they had registered with the program.
The associated expiration date and the check number on the back of the card were not part of the hack. The leaked card numbers can not be used directly for purchases on the Internet. At least the expiration date is requested. According to current knowledge, the two additional information was not collected when registering for the bonus program and should not be included in the database at all.
Mastercard pointed out that it had come to a service provider who runs the bonus program, "a security incident". There is no connection to the payment network of Mastercard.
Data could be abused for criminal purposes
Earlier this week, a spreadsheet file appeared in an online forum listing, among other things, customers' names and email addresses. Next to it were the first two and the last four numbers of the card number and in some cases also the address and telephone number of the card user. In addition, the list contained information on whether users had subscribed to a newsletter and SMS notifications. The date of birth and the dates in the column "Customer since" were made obscured. Among the more than 89,400 entries a sample check found both correct data and the name "Max Mustermann" several times.
Furthermore, there is a risk that criminals can use the information circulated to send fake emails in order to obtain passwords and other information from users.
According to information from industry circles, Mastercard already informed the issuing banks that the group would cover the costs if customers wanted to exchange their cards.