> JapanHacked_
[Resolved][Severity: Critical][Web app exploit]

Tapioca Express: payment module of its Tapioca Express online shop altered, data of 623 cards at risk

The Tapioca Express online shop was altered through a flaw in its system, and card data of 623 customers may have leaked.

Disclosed

2020-03-04

Organizations involved

1

Leaked or at risk

623

623

Downtime

Unknown

What happened

  1. Card payment on the old site stopped as the shop moved to a new site. [1]

  2. Some card companies warned of a possible leak. [1]

  3. An outside investigation found that a flaw had been used to alter the payment application. The company reported to the PPC the same day. [1]

  4. The company reported the crime to the Kitazawa police. [1]

  5. Public disclosure. [1]

Impact

Card data of {n:623} customers who paid from 17 September to 21 October 2019 (name, number, security code, expiry and payment token) may have leaked, and some may have been misused. No leak was found on the new site. [1]

Timeline

  1. Started 2019-09-17
  2. Detected 2019-10-31
  3. Disclosed 2020-03-04
  4. 169 days

Attack or cause

Method
[Web app exploit]
Impact
[Data leak]
Entry point
Web app

Data exposed or at risk

[Name][Payment card]

Services hit

Organizations involved

Open in organization search

Sources

  1. [1][News]セキュリティコードや決済トークンを含む623名分のクレカ情報流出の可能性(タピオカエキスプレス)ScanNetSecurity · 2020-03-06 08:00