PayHere Data Breach (2022): What Was Exposed & What To Do

In late March 2022, the Sri Lankan payment gateway PayHere suffered a data breach that exposed more than 65GB of payment records. The incident affected 1.6 million people and was reported on March 27, 2022. It included over 1.5 million unique email addresses along with other personal and transaction details. A month later, PayHere published a blog post on the incident titled Ensuring Integrity on PayHere Cybersecurity Incident.

What happened

The breach exposed payment records containing email addresses, IP addresses, names, phone numbers, physical addresses, purchase histories and partially obfuscated credit card data. The partial card information included card type, the first six and last four digits, and the expiry date. The total volume of exposed material exceeded 65GB. Public reporting placed the number of affected individuals at 1.6 million, with more than 1.5 million unique email addresses identified in the data.

How a breach like this happens

Payment platforms store large volumes of customer and transaction data in databases that must remain accessible for processing and customer service. When access controls, encryption at rest, or network segmentation are insufficient, an external party can copy substantial portions of those records. The resulting dataset often contains both personal identifiers and fragments of payment information because these elements are routinely combined during normal operations. Once copied, the material can be distributed or offered on forums that specialise in trading stolen records.

About PayHere

PayHere operates as a payment gateway in Sri Lanka, processing transactions between merchants and customers. Organisations of this type routinely collect and retain names, contact details, addresses, purchase histories and payment card information to complete and reconcile payments. A breach at such a service therefore involves data that directly links individuals to their financial activity, increasing the potential for misuse beyond what occurs with breaches of purely social or marketing platforms.

What was likely exposed

The records named in connection with the incident include email addresses, IP addresses, names, phone numbers, physical addresses, purchases and partial credit card data consisting of card type, first six and last four digits, and expiry date. The exact scope of every field contained in the 65GB dataset has not been independently verified beyond these categories. Organisations that process payments commonly hold additional internal fields such as transaction timestamps and merchant identifiers, but whether those were present remains unconfirmed.

Why it matters

Partial credit card details combined with names, addresses and purchase histories can be used to support targeted fraud attempts or to build more convincing phishing messages. Email and phone numbers increase the chance that affected individuals will receive unsolicited contact. For the organisation, the exposure of transaction records can affect merchant and customer trust and may prompt regulatory scrutiny under data-protection rules applicable to payment processors. The scale of 1.6 million affected individuals means these consequences extend across a significant portion of the service’s user base.

If your data was in this breach

Monitor bank and card statements for unauthorised transactions and consider requesting replacement cards if partial details appear to have been exposed. Use unique passwords for financial accounts and enable any available transaction alerts. Readers can run a free exposure scan of their email address against known breach data to determine whether their information appears in this or other publicly reported incidents.

AICompiled with AI assistance from public sources and published under our editorial standards.