The encyclopedia · Product & Design · Product decision · 2019
7-Eleven Japan launched a payment app — hackers broke in within 24 hours
7pay shipped without two-factor auth and let anyone reset a password to a new email. ¥55M stolen in three days; the app was dead in three months.
Seven & i Holdings · 7-Eleven Japan · 2019-07
What happened
On 1 July 2019, Seven & i Holdings launched 7pay, a mobile payment service for its 21,000 7-Eleven stores in Japan, joining the country's cashless-payments race against PayPay and LINE Pay. Within 24 hours customers reported unauthorised charges. By 4 July the service was suspended.
The password-reset flow let anyone who knew a user's date of birth, email and phone number reset the password — and redirect the reset link to a different email address. Accounts with no birthdate on file defaulted to 1 January 2019, making them trivially guessable. The attacks were automated.
Roughly 900 accounts were hit and ¥55 million (about $500,000) in unauthorised charges ran through linked credit and debit cards. Seven & i terminated 7pay entirely on 30 September 2019, three months after launch, refunding balances for some 400,000 users who still held deposits.
Why it happened
- The password-reset flow accepted a new email address without verifying the old one — a single missing check turned a convenience feature into an account-takeover tool.
- Missing birthdates defaulted to a known constant (1 January 2019), so the 'secret' question had a public answer.
- The launch was timed to compete in Japan's cashless-payments subsidy race, and the schedule left no room for a security review.
The lesson
A launch date set by competitors' subsidies is not a security review. Ship the feature that can be attacked last, not first.
Sources
- Seven & i Holdings press release: termination of 7pay (1 August 2019)
- The Verge: 7-Eleven Japan shuts mobile payments app after security flaw
spotted an error? The club wants to know.
More like this
Anker PowerConf S3: a recall that burned two years after the notice
final's TWS03R: 17 fires on earphones recalled 18 months earlier
Dynabook's 2008 adapters: still catching fire eight years into the recall
Somewhere, someone solved the problem this company failed at. 2nd Opinion →
Comments · 0
Sign in to join the comments.