Instarem major privacy breach: Customer and Amaze card details compromised

Instarem had a major privacy incident last night in which user data — including full names, email addresses, transaction history and even Amaze card details — was made visible to other users via the Instarem app and website.

As expected, Instarem is trying to downplay the issue, but this is an extraordinary breach that is going to significantly undermine customer confidence. Something went very wrong yesterday, and there are serious questions to be answered.

What happened?

Last night, Instarem customers reported that they were seeing the details of other users in their Instarem app, including:

• Full name
• Email address
• Mobile number
• Transaction history
• Recipients
• Last 4 digits of linked cards
• Amaze Card details

Based on reports in the MileChat, there were multiple users whose data was exposed, across different countries including Singapore. Many people found themselves logged in to the same account, as seen from this screenshot of a support chat where multiple people were sending messages from the same account. 

The incident was finally resolved around 10 p.m, when regular functionality was restored and users were logged back into their proper accounts. 

But of course, this breach has raised some major concerns— if I could see someone else’s data (including their Amaze card details!), could someone else have been viewing mine?

Instarem’s response

Instarem sent out the following email to customers last night acknowledging the issue and promising an investigation. 

Now, I don’t know about you, but I have issues with how Instarem is characterising the breach.

First, there’s the timeline. Instarem says the issue began at 8.50 p.m SGT and was resolved within 30 minutes. However, multiple reports of users seeing other people’s data were still coming in close to 10 p.m. That suggests the actual “exposure time” may have been longer than Instarem is willing to admit.

Second, Instarem claims that “a limited number of users” saw unrelated customer data. Really? The MileChat was flooded with similar reports, as were other Telegram communities and Reddit. Even my father, currently in France, sent me a panicked message saying that his account had been hacked and he was seeing the details of some Portuguese guy in his app.

That doesn’t feel limited to me, and perhaps Instarem is trying to play with semantics by saying “yes, everyone could have seen it in theory, but since the incident was resolved relatively quickly, only a limited number of users actually did”.

Third, Instarem says no sensitive data was exposed, which is hard to believe given what people reported seeing. Beyond full access to Amaze card details (including expiry dates and CVV codes), there was certainly enough information here to potentially answer security questions for banks and other financial institutions.

Unless this all turns out to be dummy data from test accounts (and if that were the case, I suspect Instarem would have already come out and said so), then I don’t understand how this isn’t considered sensitive. It could be another case of word games, as Instarem explicitly mentions identification numbers, financial details, and passwords as examples of sensitive data — all of which aren’t stored in the app anyway (though wouldn’t Amaze Card details be considered financial details?).

Of course, I want to acknowledge that the email says “your” customer data has not been compromised, and not “no” customer data has been compromised. There is a possibility that Instarem is sending this particular email to accounts it has verified were not compromised during yesterday’s incident, while those which were are getting a different email.

This might be the case, because there’s a second email circulating to certain customers, informing them their Amaze Card has been blocked and asking them to request a replacement. 

Ironically, this customer also reported receiving the first email, which is absurd to say the least. On the one hand, your sensitive data (including financial details) wasn’t compromised, on the other, your Amaze Card has been compromised!

What about my linked cards?

Since Amaze is a passthrough that is linked to various credit and debit cards, any concerns about Amaze will naturally raise concerns about the linked cards as well.

I don’t think you need to be worried about this, however, because the Instarem app does not store the details of your linked cards beyond the last four digits. It’s impossible to reverse engineer them from the app too. 

I mean, if it helps you sleep better at night, by all means go request a replacement, but I personally don’t see the need to do so.

Conclusion

Instarem experienced a major incident last night that exposed user data — including mobile numbers, email addresses, and Amaze card details — to the public. This is a serious breach, and one that deserves attention from both the mainstream media and relevant authorities.

In the meantime, the company has some pressing questions to answer: How did this happen? What steps is it taking to make sure it never happens again? And how can users trust it to protect their data going forward?

I’ve reached out to Instarem with some questions, and will update this post when I receive a reply.