Merchant Customer Exchange

Summary

The mobile payment system CurrentC, developed by Merchant Customer Exchange (MCX), experienced a data breach prior to its official launch, compromising pilot participants' email addresses. MCX notified affected users and warned of potential phishing attempts leveraging the stolen data. The organization confirmed no sensitive financial information was accessed, as the service had not yet fully launched. The incident heightened scrutiny of the platform's security posture amid its competitive positioning against established payment services.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

The CurrentC mobile payment system experienced a cybersecurity incident prior to its official service launch, as reported in October 2014. CurrentC was developed as a competitor to Apple Pay by the Merchant Customer Exchange (MCX), a consortium of major retailers seeking an alternative mobile payment solution. The breach occurred during the system's pre-launch phase, though specific technical details regarding attack vectors, data exfiltration methods, or intrusion timelines were not disclosed in available reports. No information was provided about whether user data, payment information, or backend systems were compromised during the incident. The attack represented a significant security setback for the fledgling payment platform before it could establish market presence against established competitors.

The incident's discovery prompted internal investigations by MCX, though no public documentation exists regarding forensic findings or containment measures implemented. No consumer notifications or breach disclosures were confirmed, likely due to the service not yet being operational with live users. The hack occurred amidst intense competition in the mobile payments sector, with Apple Pay having launched just weeks earlier in October 2014. MCX member retailers including Walmart and Best Buy had previously committed to exclusivity with CurrentC, blocking Apple Pay adoption in their stores. The breach's full operational and financial impacts remain undocumented in public sources, with no subsequent reports detailing service delays, technology changes, or post-incident security enhancements to the platform.

Sources

Sources available to members: 1 source.