> JapanHacked_
[Resolved][Severity: Critical][Web app exploit]

Ichimasa Kamaboko: payment module of the Ichimasa Online Shop altered, data of 303 cards at risk

The Ichimasa Online Shop of fish-paste maker Ichimasa Kamaboko was altered, and data of 303 payment cards may have leaked.

Disclosed

2020-02-18

Organizations involved

1

Leaked or at risk

303

303

Downtime

Unknown

What happened

  1. The company learned of a possible card data leak. [1]

  2. It shut the site and asked an outside firm to investigate. [1]

  3. The investigation found that a flaw had been used to alter the payment application. [1]

  4. The company reported to the Niigata Higashi police, and to the PPC on 28 November. [1]

  5. Public disclosure. [1]

Impact

Card data of {n:303} cards used from 1 July to 17 September 2019 (number, name, expiry, security code) may have leaked, and some may have been misused. [1]

Timeline

  1. Started 2019-07-01
  2. Detected 2019-09-09
  3. Disclosed 2020-02-18
  4. 232 days

Attack or cause

Method
[Web app exploit]
Impact
[Data leak]
Entry point
Web app

Data exposed or at risk

[Name][Payment card]

Services hit

Organizations involved

Open in organization search

Sources

  1. [1][News]「いちまさオンラインショップ」に不正アクセス、セキュリティコード含む約300件流出可能性(一正蒲鉾)ScanNetSecurity · 2020-02-21 12:30