Pet Hug: payment page of its online shop tampered with, data of 4,098 cards at risk

The payment module of the Pet Hug pet food shop was altered, and even after card payment stopped a fake form kept stealing card data.

Disclosed

2020-01-15

Organizations involved

Leaked or at risk

4.1K

4,098

Downtime

Unknown

What happened

2018-06-28
Through a flaw in the system, the payment application was altered; this lasted until 7 May 2019. [2]
2019-05-07
After a warning from card companies, card payment was stopped. [2]
2019-05-18
Customers were still sent to a fake payment form, which took card data until 20 May. [1]
2020-01-15
Public disclosure. [1]

Period	Cards
Altered payment module (28 June 2018 to 7 May 2019)	4,011
Fake payment form (18 to 20 May 2019)	87

The data includes name, number, expiry and security code, and may have been used fraudulently. [2]

Service	Role	Impact level	Note
Pet Hug site	[Breached]	[Critical]

[Breached][Critical]Kanagawa, FujisawaWholesale and retail trade4,098 leaked
Pet Hug Inc.

						Note
Pet Hug Inc.	[Breached]	[Critical]	Kanagawa, Fujisawa	Wholesale and retail trade	4,098