Users wary of using Samsung Pay after LoopPay breach

Samsung has assured its users that the recently launched mobile payments system is “unaffected” after its crucial technology, called LoopPay, was hacked. The tech giant acquired LoopPay, an American payments startup, in February.

“Samsung Pay was not impacted and at no point was any personal payment information at risk,” Darlene Cedres, Samsung’s chief privacy officer, said in a statement. “This was an isolated incident that targeted the LoopPay corporate network, which is a physically separate network. The LoopPay corporate network issue was resolved immediately and had nothing to do with Samsung Pay.”

The hackers going by the name Codoso Group or Sunshock Group infiltrated LoopPay’s network in March and went undetected till August. LoopPay executives said the hackers seemed to have been after the company’s technology, called Magnetic Secure Transmission (MST), which is integral to the Samsung Pay mobile payment wallet, The New York Times reported.

Will Graylin, LoopPay’s chief executive and co-general manager of Samsung Pay, said that security experts were still examining LoopPay’s systems, but that there had been no signs that the hackers breached Samsung’s systems or that consumer data had been compromised.

Both LoopPay and Samsung executives said they were positive that the infected machines had been removed, and that customer payment information and personal devices were not affected. They further said that there was no need to postpone the introduction of Samsung Pay, which had recently set its foot in the United States after executing over $30 million worth of purchases in South Korea, The New York Times reported.

However, it is natural for Samsung Pay users to feel apprehensive. Lawyer Toren admitted that he would not use it, The Street reported. “I would not be comfortable using Samsung Pay," he said. "There are alternatives.”

Chenxi Wang, chief strategy officer at security company Twistlock, also offered skepticism: “As a Samsung Pay user, I deleted my credit card from the system and will stop using the service for at least a while. I am sure the server already has my credit card information, so I'll be putting a fraud alert on my credit.”