What happened

PayPerQ accounts are identified by a credit id. There is no username or password by design; the credit id is the key to the account, which is what lets people use PayPerQ without giving us an email address.

Every account also has a referral link. Many users post theirs publicly, on their websites, in forum signatures, in directories of privacy tools, and so on. That is what the links are for.

On October 8 and 9, an attacker collected a large number of these publicly posted referral links. They then exploited a bug in our referral system: when someone opened a referral link, the new account the site created for the visitor contained the link owner's credit id in a response that should never have carried it. Anyone who opened your referral link and knew where to look could read your credit id back out of their own account.

With those credit ids, the attacker moved credit out of the affected accounts, mostly by creating gifted links from their balances and redeeming them into accounts he controlled, and later by spending directly through the API.

Who was affected

A few dozen accounts, all of them people who had shared a referral link publicly. The total taken was about $500 across all of them. If you never created or shared a referral link, this did not affect you.

No names, email addresses, passwords, conversations or payment details were involved. The only thing exposed was the credit id of the referral link's owner.

What we did

• We closed the bug as soon as we identified it. A referral link can no longer reveal anything about its owner.
• Over the following days we traced how the referral links had been used and identified every affected account.
• We retired the gifted links feature, which was the main way credit was moved out of the affected accounts.
• We froze every affected credit id. Nothing can be spent from those ids by anyone, and the money and referral earnings on them are safe. Our backend now refuses every request on a frozen id, and the referral and account-management routes refuse them too.
• We are issuing replacement credit ids. Each affected person gets a new id with their balance, their referral link and its earnings moved across, so their published links keep working.

What you need to do

If your account was affected, you will see a notice when you open ppq.ai, and API requests on that credit id return an error explaining the situation. The notice asks you to email matt@ppq.ai with either a receipt or transaction id from a payment you made to the account, or from a domain belonging to the website where you posted your referral link. If you cannot do either, email anyway and we will work out another way to verify you. Once verified, you receive your new credit id by reply, with your full balance restored, including what was taken.

If you do not see that notice, your account was not affected and there is nothing you need to do.

Going forward

Credit ids being the only credential is a deliberate trade-off that makes anonymous accounts possible, and it means any code path that can reveal one is a serious problem. We have reviewed the other places a credit id is returned by our servers and tightened them to return only what each page needs, and we have added monitoring for the kind of behaviour that signalled this attack.

I'm sorry this happened. If you have any questions, email me at matt@ppq.ai.