Discount Codes Security Breach

[cheeseontoast]

We put a new discount code on last night, we haven't released to our customers yet, that was due to be as from today.

Last night approx four hours after upload we received two orders, one from Australia and one from Malaysia, both had used this new code.

There is obviously a security hole in Actinic. Any advise?

Karl

[Duncan Rounding]

Was it a simple code, such as short word or similar, or a more complex one - ie could a robot have cracked it by trial and error perhaps?

[Krithika]

Hello Karl

Thank you for bringing this to our notice. I have raised an issue for the same and have notified the team as well.

Regards

[cheeseontoast]

re code

Hi - no, they had no chance of guessing the code and we'd never used it before.

Very strange.

Thanks Actinic, hope this get solved asap.

[I-CC]

Are you sure that you enabled it as a coupon code enabled discount.

The only discount I can see which is valid on your movie-stuff website is automatically applied and does not require a coupon code, whereas all of the other discounts date back to last year, so this is the only valid one on your movie-stuff site as of now and does not require a coupon code.

[brucet]

Were the hijacked coupons single use or multiple use? The two are stored differently. And what kind of discount did they enable - was it specific to certain product groups, or a discount off anything?

Also, which site did the coupons apply to?