Company News

22 Oct 2021

AsiaPay partners with Pace to give shoppers more freedom to buy what they need with a 'Buy Now Pay Later' option

04 Oct 2021

AsiaPay partners with WorldFirst to offer international payout service to merchants.

29 July 2021

AsiaPay partners with interest-free payment powerhouse HUMM to launch buy now pay later service in Australia.

20 July 2021

AsiaPay partners with Aitea to offer more payment options to their customers during checkout.

20 April 2021

AsiaPay partners with Qiscus to enhance customer experience with frictionless checkout and payment.

15 March 2021

AsiaPay partners with Trabble to enhance the booking experience and capabilities to make payments.

23 February 2021

AsiaPay partners with Atome to accept "Buy Now Pay Later" payments in Hong Kong and Singapore.

06 January 2021

AsiaPay partners with Zip to accept buy-now-pay-later payment.

20 November 2021

The 2021 Finance Law Academic Research seminar of the province of Guangdong

22 October 2021

ASEAN Entrepreneurship & Market Development Forum

15 September 2021

The Department of Trade and Industry (DTI)-Export Marketing Bureau (EMB) x Malaysia Digital Economy Corporation (MDEC): Virtual Business Matching Event.

19 August 2021

New Norms To Innovate Your Business Towards Digital Transformation.

22 July 2021

Megaworld International Virtual Property Expo 2021.

21 April 2021

IMRG Delivery Summit 2021: Achieving delivery excellence in light of Brexit and the pandemic.

14 April 2021

Interviewed by The Finest Singapore.

6 April 2021

Interviewed by MARKETECH APAC.

22 February 2021

Interviewed by The Paypers.

20 August 2021

PFI INVESTIGATION RESULTS OF SECURITY INCIDENT

Hong Kong, 20 August 2021 — AsiaPay (“the Company”) announces today that the investigation conducted by the PCI certified Forensic Investigator (“PFI”) has been concluded. In this connection, it is with regret that the Company now informs stakeholders and supporters that a highly sophisticated cyberattack on our systems has been discovered of which, according to the PFI, had transpired between the periods of 4 August 2020 to 5 May 2021 (“the window of intrusion”) which had occurred after our Data Center migration.

From the outset, it should be noted that according to the PFI’s investigation, relevant vulnerabilities have since been removed and as of 5 May 2021, the breach has been validated by the PFI as contained and card data on our systems are no longer at risk.

Insofar as further details into the PFI investigation are concerned, the Company now takes this opportunity to disclose to our stakeholders that we have sourced and engaged the PFI in early December 2020 which was as soon as after having received the first report of suspicious incident.

The Company further notes that the initial investigation in Card Data Environment (“CDE”) did not reveal any suspicious security traces and such was the conclusion of the PFI until 14 April 2021. According to the PFI’s findings:

1. The attackers had managed to infiltrate CDE via our testing server and gained access to data.
2. The data elements exposed or possibly exposed were but not limited to cardholders’ names, the card validation codes/values, the primary account number, the card expiry dates and the decryption keys of debug logs.
3. Finding of malware output files with 44,000 cards was reported. A total number of 12 million cards was identified as data storage at risk which might be exposed or potentially exposed.

Since the incident, the Company formed an Incident Response Team which had taken the necessary steps immediately to prevent further such attacks. Along the investigation process, we had worked closely with card schemes, banks and investigators. Besides such measures, the Company had also worked with relevant regulators, law enforcement and merchants to assist in communication and to minimize potential impact to cardholders.

Along our work with the PFI, we had deployed a series of effective containment and improvement measures in response to the attacks and kept monitoring. Furthermore, we had engaged other information security technology firm to further enhance our security monitoring and controls. The suspicious activities have effectively ceased since the implementation of these security measures and the incident has been concluded by the PFI as contained.

The Company continues to communicate closely and fully collaborate with relevant regulators, bank partners and clients across the region on this incident. We have sought to understand and learn from the incident and have taken robust steps to enhance our security controls to prevent this type of incident from happening again.

The Company would like to thank the card schemes providers for their continued guidance and support over the investigation period. Through the collective efforts of PFI vendor and our colleagues, we confirm that our environment is now safe and free from any new suspicious activities.

We sincerely regret any inconvenience caused to our merchant clients and bank partners. Security is our top priority. Please be assured that we value the protection of everyone’s payment data security and have undergone a complete overhaul of our security architecture to bring necessary safety to our payment processing.

Any questions or concerns regarding the incident, please feel free to contact us at +852 3173 1929 on weekdays between the hours of 9 a.m. to 5 p.m. or email to [email protected].

聯款通發表有關保安事件的調查結果

香港，2021 年 8月 20 日 — 聯款通 (「公司」) 今天謹此公佈由獨立專業的網絡安全公司 (PCI certified Forensic Investigator，PFI) 就保安事件的調查報告結果。就此，我們很遺憾地告知相關持份者和支持者 — 根據 PFI，於2020年8月4日至2021年5月5日期間 (「入侵窗口」) ，亦是早前公司遷移數據中心後，公司的系統發現遭受精密的網絡攻擊。

PFI就事件作出調查後，結果顯示相關漏洞在事後已獲處理，並且經其驗證，於2021年5月5日確認相關缺口已被防堵，而信用卡數據已不再面臨風險。

我們謹此告知我們的商業夥伴及客戶到目前為止有關PFI 調查的進一步細節。公司在首次發現系統出現潛在入侵事件後，於2020年12月初已立即作出行動並委派PFI進行調查。

公司進一步注意到就持卡人數據環境(Card Data Environment ，CDE) 進行的初步調查中未有發現異狀，直至 2021 年 4 月14日才發現可疑的安全漏洞痕跡。根據PFI調查結果顯示：

1. 攻擊者透過入侵我們的測試伺服器，滲透至 CDE並存取數據。
2. 外洩或有機會外洩的數據資料包括但不限於信用卡持有人姓名、信用卡驗證碼、主帳戶號碼、信用卡到期日及除錯記錄的解密金鑰。
3. 報告發現由惡意軟件輸出檔案的信用卡數量為44,100張；而被判別為外洩或有機會外洩的信用卡總數量為1,200萬張。

事件發生後，公司成立了一個應對小組並已即時採取多項應對措施以防止再次遭受同類攻擊。調查過程中，公司與信用卡機構、銀行和調查機構緊密合作。另外，我們亦與相關監管機構、執法部門和商戶溝通合作，以減少對持卡人的潛在影響。

隨著我們與 PFI 的合作，公司已部署了一系列有效的防堵和改善措施應對同類攻擊，並持續進行監察。此外，我們還聘請了其他資訊保安公司，務求進一步加強我們的保安監察和控制。自實施了加強保安措施以來，已有效終止了可疑活動，PFI 亦作出結論，認定該事件已受到防堵。

公司將繼續就此事件與亞太地區的監管機構、銀行合作夥伴和客戶作出緊密溝通和充分合作。我們已尋求深入了解是次事件及從中汲取教訓，並已採取有效對策加強我們的保安措施，預防同類事件再次發生。

公司非常感謝信用卡機構在調查期間一直提供指引和支持。透過PFI供應商和我們的團隊攜手合作，確認我們的環境現已安全，並沒有任何新的可疑活動。

我們對客戶、銀行合作夥伴和受影響商戶所帶來的任何不便深表遺憾。保安是我們優先考慮的要務。我們將繼續確保所有的付款數據安全，並已全面審查和更新我們的保安架構。

如對事件有任何查詢，請在工作日上午 9時至下午 5時致電 +852 3173 1929，或發送電子郵件至 [email protected]。

22 July 2021

Media Statement on Potential Security Incident (Revised)

Hong Kong, 22 July 2021 – AsiaPay would like to report that the Company’s payment gateway may have encountered a potential credit card data compromise incident. This would have potentially occurred during the period from August 4, 2020 to May 5, 2021.

The Company has taken immediate action to engage a professional cybersecurity firm to effectively contain and investigate the incident. There has been no further suspicious activity since May 3, 2021 onwards post implementation of these measures. The Company has also immediately implemented various measures to further strengthen our security, including software upgrades, fortification of authentication processes, increasing cybersecurity resources, as well as reinforcing internal training and governance. The Company’s daily operations remain unaffected and the protection of payment data is our utmost priority.

The investigation remains on-going and more updates and detailed findings will be shared in due course. We have reported the incident to the relevant authorities and are swiftly notifying merchants, customers and stakeholders potentially impacted.

At AsiaPay we take information security extremely serious and will continue to take ongoing measures to enhance our IT security.

有關潛在安全事件聲明 (更正)

香港，2021 年 7 月 22 日— 聯款通謹此公佈公司的支付網關可能遇上潛在信用卡數據洩漏事件。是次事故可能發生於 2020 年 8 月 4 日至 2021 年 5 月 5 日期間。

公司已立即採取行動，聘請專業的網絡安全公司就事件進行有效管控和調查。公司亦同時加強安全措施，包括軟件升級、加強身份驗證流程、增加網絡安全資源，以及加強公司內部培訓和管理。自措施實施後, 從2021 年 5 月 3 日起已沒有發現新的可疑活動。公司的日常運營不受影響，而我們一直把支付數據安全及保護放於首位。

事件的調查仍在進行中，更多調查結果將適時公佈。我們已向有關當局報告事件，並正迅速通知可能受影響的商家、客戶和持份者。

聯款通非常重視信息安全，我們將持續採取措施提高系統的安全性。

11 June 2021

Media Statement on Potential Security Incident