Verizon Business is appointed to conduct forensic investigation into Juspay data breach

Payment processor Juspay has roped in Verizon Business to conduct an independent forensic Investigation into the cyber-attack the company faced in August last year. It has also roped in PricewaterhouseCoopers (PwC) to undertake a comprehensive audit of policies, protocols, and technologies.

Juspay, earlier this week, had said it faced a cyber-attack on August 18 last year. It had stated that the breach was restricted to an isolated system containing non-sensitive masked cards, primarily used for display purposes on merchant UI (user interface) and cannot be used for completing a transaction.

"Following several measures undertaken to further improve information and systems security at Juspay, we have appointed Verizon Business to conduct an independent PCI Forensic Investigation (PFI).

"We have also appointed PricewaterhouseCoopers (PwC) to undertake a comprehensive audit of policies, protocols, and technologies," Juspay inked in a blogpost on Thursday.

These would help enhance resilience and preparedness to mitigate threats from unlawful cyber-attacks, it added.

"With the work undertaken by both Verizon and PwC, we want to combine their global expertise with our experience to ensure that we are more cyber resilient and better prepared to face and defeat similar threats in the future," Juspay said.

Asked about the reason for delay in initiating forensic investigation, a Juspay spokesperson said: "Yes, we should have initiated the forensic investigation earlier. However, following the cyber-attack, our priority was to ensure cardholders data and API keys are secured, as well as to strengthen our security response to prepare better against any future attempts on our servers and store".

"Immediately after the incident we worked with our merchant partners and notified them of the intrusion. We issued fresh API keys, though it was later verified that even the API keys in-use were safe. Thereafter, we conducted a thorough internal audit towards enhancing our technology, security protocols," the spokesperson said.

The spokesperson also added that the company has standardised 'Enforced 2 Factor' authentication for all infrastructure access routes for all developers.

Previously Juspay had said it is in close contact with the relevant government authorities and the RBI regarding the cyber-attack.

Also, it had explained that about 3.5 crore records with masked card data and card fingerprint (which is non-sensitive information) were breached as part of user metadata in its system which has non-anonymised, plain-text e-mail IDs and phone numbers.

The masked card data is used for display purposes on merchant UI and cannot be used for completing a transaction, Juspay had said.