PETALING JAYA: Electronic payment service provider E-pay’s parent company GHL Group said it is investigating allegations that its customer data has been leaked online.
“An unconfirmed report has been circulating in the media, claiming that there has been a data compromise of E-pay and that a Threat Actor is selling customers’ PII (personal identifiable information) data and credentials related to our website.
“We are currently investigating these serious allegations and are checking into our system,” the company said in a statement.
GHL Group clarified that the allegations are isolated only to the E-pay online reload and bill payment collection (E.V.E), adding that the possible breach does not affect its other businesses and operations.
“The E.V.E system operates on an independent stand-alone system which does not interfere with the technical operations of other E-pay and GHL merchant acquiring systems and servers,” the company said.
A user on Twitter had earlier claimed that a threat actor is selling data belonging to 380,000 E-pay customers on a hacker forum.
Screenshots of the forum posting detailed how the alleged customer records include details such as names, email addresses, passwords and home addresses.
Website Lowyat.net claimed to have found the database on the forum where the seller offered the data set for US$300 (RM1,216), adding that the posting has since been removed.
GHL Group advised E.V.E users to change their passwords on the official website as a precautionary measure.
“E.V.E users should not click on unverified email links urging them to update their credentials but to do so only on our official website,” it added.
The E-pay service allows users to perform various online transactions – including pay for utilities such as electricity and water bills, purchase mobile prepaid and e-wallet top-ups, remit money and more – through the website and mobile app.
Already a subscriber? Log in
Get 20% OFF The Star Digital Access
Cancel anytime. Ad-free. Unlimited access with perks.
