Monzo says it wasn’t storing ‘some’ customer PINs correctly, but has now fixed the bug

guest · Aug 5, 2019

Monzo says it wasn’t storing ‘some’ customer PINs correctly, but has now fixed the bug
August 5, 2019
https://techcrunch.com/2019/08/05/m...mer-pins-correctly-but-has-now-fixed-the-bug/

Monzo, the fast-growing challenger U.K. challenger bank that recently soft-launched in the U.S., is disclosing a potential, albeit relatively limited, security oversight that saw customer PINs stored incorrectly within the company’s internal systems.

Discovered on Friday, the “bug” has now been squashed after being spotted by one of Monzo’s security engineers, co-founder and CEO Tom Blomfield told me on a call just a few moments ago. Specifically, the security lapse meant that some customer PINs were simultaneously stored in encrypted log files accessible by certain Monzo staff.

In a blog post just published, Monzo provides the following context for the bug, including who could access customer app PINs as a result
“If we’ve contacted you to tell you that you’ve been affected, you should head to a cash machine to change your PIN to a new number as a precaution,” advises Monzo.
Click to expand...

guest · Aug 6, 2019

Monzo's PIN security breach, explained
August 6, 2019
https://www.wired.co.uk/article/monzo-pin-security-breach-explained

Half a million customers of Monzo, one of the UK’s digital challenger banks, have been advised to change their PINs after they were left in a vulnerable file accessible by the company’s engineers for more than half a year.

“This is pretty embarrassing because they are a financial institution, one of these new digital banks,” says cybersecurity expert Graham Cluley. “This isn’t the kind of thing you want to have to tell your customers – to change their PIN numbers.”
Warren says that the fundamental issue is providing too much access to a particular file to too many people. “It was a design flaw when building the application. That data shouldn’t have been stored in a log file. Design review should have caught that before building.”

Though the company has been at pains to say it has not seen any fraudulent behaviour, asking users to change their PINs is still the right thing to do, says Cluley.
That’s not because the accounts are at a higher risk of fraud per se, but in case the erroneous file containing the PINs accidentally made it outside of Monzo headquarters.
Click to expand...

Log in or Sign up

Monzo says it wasn’t storing ‘some’ customer PINs correctly, but has now fixed the bug

guest Guest

guest Guest

Log in or Sign up

Monzo says it wasn’t storing ‘some’ customer PINs correctly, but has now fixed the bug

guest Guest

guest Guest

Useful Searches