Leaked CROSS POINT API key exposed one customer’s membership data

I’LL says the attacker used one customer’s legitimate API key after it leaked and obtained member data through the member information API. The vendor attributes the access to credential abuse and reports no direct database intrusion, tampering or software flaw. It found no signs of disclosure at other customers as of the notice. The affected organization, the number of member records and how the key leaked remain undisclosed.

The accessed data includes names, dates of birth, gender, postal and contact details, member numbers and tiers, points balances, in-store loyalty card numbers, online member IDs, and purchase statistics such as total spend, purchase counts and first or last purchase dates. The vendor says the affected system did not store payment-card data or login passwords. The product-wide key rotation applies to all customers and the confirmed data retrieval concerns one customer organization.