Breaches and incidents
Compagnie des transports strasbourgeois (CTS), Strasbourg (France): API abused to steal data of about 230,000 customer accounts
Per Clubic, CTS announced on 28 Oct that about 230,000 customer accounts (nearly 40% of accounts) were affected.
- Disclosed
- Verification
- Reported by a reputable outlet, citing the company
What happened
- Per Clubic, CTS announced on 28 Oct that about 230,000 customer accounts (nearly 40% of accounts) were affected; attackers retrieved names, first names and dates of birth. CTS said passwords and banking data were not exfiltrated.
- Root cause: per CTS, “they used an API to steal data”; the attack took place overnight 18 to 19 Oct and the flaw has been fixed. CTS said the attackers did not infiltrate its IT system.
- No attacker named.
- CTS filed a declaration with the CNIL, said a complaint is to be filed with the Strasbourg court, and notified affected people by email.