Gendai Guitar: intrusion into the GG Internet Shop puts card and customer data at risk

1. 2019-10-23

   A customer reported a fault on the site. [1]

2. 2019-10-24

   A possible leak was found and the shop was shut down. [1]

3. 2019-11-22

   The outside investigation ended and confirmed that card and personal data may have leaked. [1]

4. 2019-12-03

   The company reported to the PPC and to the police the next day. [1]

5. 2020-01-07

   Public disclosure, with emails to those affected. [1]

• Card data of {n:133} customers who paid by card from 6 to 24 October 2019 (name, number, expiry, security code); some may have been misused. [1]
• Data of {n:19328} customers registered from 25 June 2008 to 24 October 2019 (name, gender, address, phone and fax numbers, email, encrypted password). [1]

A flaw in part of the system let the attacker alter the payment application and take data from the server. [1]