Soft On Demand: the SOD Prime video service showed other members' account data, for up to 68,898 people

1. 2020-03-16 12:24

   The company started using a CDN to cope with heavy traffic. [2]

2. 2020-03-16 22:50

   The card payment agent reported that logging in switched users to someone else's account; the site was shut at 22:57. [1] [2]

3. 2020-03-17 03:21

   The service reopened with caching of personal data turned off, but the problem continued, and it was shut again at 21:01. [2]

4. 2020-03-19

   Public disclosure. [1]

5. 2020-03-27

   Corrected times and the findings on the cause were published. [2]

Nicknames, email addresses, purchase and viewing histories, reviews, uploaded videos and membership status of up to {n:68898} people could be seen by other users. For 564 people with a delivery address, names, addresses and phone numbers were shown too. Card data was not stored. [2] [1]

Information that should never have been cached was stored by the CDN and served to other users. The first fix probably failed because the server's settings were not applied correctly at the CDN. [2]

The company returned to its setup without the CDN. It offered 5,000 yen to members whose delivery details were seen, 500 site points to others whose data was seen, and a month's refund to monthly members. [2]