PayHere payhere.lk PayHere data breach: what happened and what to do
In late March 2022, hackers took more than 65GB of payment records from Sri Lankan payment gateway PayHere, including 1,580,249 unique email addresses. Names, phone numbers, physical and IP addresses, purchase history and partial card data were exposed.
View all 13,115 breaches- Breach date
- 27 Mar 2022
- Affected
- 1,580,249
- Data exposed
- Email addresses, IP addresses, Names, Partial credit card data, Phone numbers, Physical addresses, Purchases
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
PayHere is a Sri Lankan payment gateway that online shops use to take card payments. In late March 2022 it suffered a data breach that exposed more than 65GB of payment records, according to Have I Been Pwned. The data covered 1,580,249 unique email addresses.
About a month later, PayHere published a blog post about the incident. It said the attack hit all of its services and caused a service outage, that it reported the incident to Sri Lanka's Cyber Crime Investigation Division, and that it was working with legal experts to act against the attacker.
What was exposed
The records include email addresses, names, phone numbers, physical addresses, IP addresses and purchase histories. Card data was partly obscured: card type, the first 6 and last 4 digits, and the expiry date. Full card numbers were not part of it.
That is enough for convincing scams. A message that quotes your real purchase, your name and the last 4 digits of your card looks like it came from the shop or your bank. Phone numbers also make text-message scams easier.
What it means for you
If you bought from a Sri Lankan online shop that used PayHere, check your email on Have I Been Pwned or run a free Serus scan. Serus monitors breach databases and the dark web for your email and phone number and alerts you when they show up, but it can't take breach data back out of circulation. What you can do is make the data less useful, using the steps below.
What to do if you were in it
- 1
Treat messages that mention a purchase as suspect
Scammers can quote real order details. Don't click links in unexpected emails or texts about a payment. Open the shop or your bank's site yourself.
- 2
Watch your card statements
Partial card numbers and expiry dates were exposed. Check statements for charges you don't recognize, and ask your bank for a new card if you want to be safe.
- 3
Expect scam texts and calls
Your phone number and address were in the data. Don't confirm personal details to anyone who contacts you first.
- 4
Check whether your email or phone is in this and other breaches
Run a free Serus scan to see which breaches include you and what leaked in each.
Frequently asked
Was I affected by the PayHere breach?
If you paid through PayHere around or before March 2022, possibly. Search your email on Have I Been Pwned, which lists 1,580,249 affected email addresses, or run a free Serus scan.
Were full card numbers leaked?
No. The data held the card type, the first 6 and last 4 digits and the expiry date, not the full number.
Do I need to change my password?
HIBP doesn't list passwords for this breach. Changing a password on a site that holds your payment details is still a cheap precaution.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
