Chinese hackers breached Samsung Pay’s core technology

hand holding a samsung galaxy phone using the samsung pay payment service whilst another person holds the POS terminal

Samsung has been receiving some positive news in the last couple of months. First, people eagerly awaited the release of its mobile payment system and then when it was released the figures have been encouraging.

However, now there have been some less pleasant news. Chinese hackers have managed to breach the security of LoopPay, the payment technology company that Samsung acquired earlier this year for $250m, and the technology of which is at the heart of Samsung Pay, the New York Times reported.


Attack happened a month after the acquisition

The paper said the attack happened as early as March 2015 and that the hackers were after the technology known as magnetic secure transmission, which Samsung is using to allow its phones to interact with magnetic stripe readers.

The hackers managed to break into the startup’s corporate system but not the production system that is the one that actually helps manage payments.


Breach discovered in August

LoopPay only discovered the existence of a breach in late August, just a month before Samsung Pay launched in the US.

Following the revelations of the breach, Samsung quickly moved to stress that no information was actually affected.

“The first thing to know is that Samsung Pay was not impacted and at no point was any personal payment information at risk,” said Darlene Cedres, Samsung’s chief privacy officer, in a statement.


Isolated incident

It said this was an isolated incident that targeted the LoopPay office network, which is a physically separate network from Samsung Pay.

“It’s worth reiterating that the reported incident was related to LoopPay’s office network which handles email, file servers and printing within the company. This network is physically separate from the production network that handles payment transactions and run by Samsung.”

Both Samsung and LoopPay have said the infected devices have been identified and removed.


Too early to assume nothing was taken

However, the NY Times cites two people who are familiar with the incident and investigation who say that it is still premature to assume the hackers did not achieve what they set out to do.

Related reading

Leave a comment