7-Eleven Japan shut down its 7Pay mobile payment app two days after launch after hackers reset passwords for ~900 accounts and made ~$500K in illegal charges
Hackers exploit 7-Eleven's poorly designed password reset function to make unwanted charges on 900 customers' accounts.
Context & Ripple Effects
7Pay's launch-to-shutdown took just two days, making it one of the fastest deaths of a major mobile payment service on record. The mechanics mirror the Starbucks app thefts from 2015, where criminals drained money by abusing stored payment cards behind weakly protected accounts — only here the entry point was a password-reset function left open to abuse rather than weak passwords themselves.
The breach also lands on a country already under security pressure: Japan has absorbed a run of incidents from the HappyHotel server breach to Omiai's exposure of 1.7M+ users' data, and regulators showed after the Coincheck hack they will act decisively, when they punished seven cryptocurrency exchanges and suspended two. A flagship retailer fumbling a payments launch gives that oversight a fresh, high-profile target.
First-order effects
- Roughly 900 customers have unauthorized charges — about $500K total — billed through payment methods stored in their 7Pay accounts, and 7-Eleven Japan must absorb refunds plus the cost of killing a service it had just launched.
Second-order effects
- Every operator of a stored-credential wallet faces pressure to re-audit its own password-reset flow, since the Starbucks precedent shows this account-takeover template gets reused against whichever app leaves the door open.
- Japanese regulators who cracked down on exchanges after Coincheck have a retail payments failure to point at, raising the likelihood that mobile payment apps get pulled into stricter security supervision.
Third-order effects
- If account takeover via reset and recovery flows keeps draining stored wallets, the industry shifts toward harder identity proofing at exactly those steps — making verification of 'is this really the user' the load-bearing control for cashless payment adoption.
The trend: Mobile wallets are turning account-recovery flows into the primary attack surface for stored payment credentials, pushing regulators and operators toward stronger identity verification at every reset step.