[Resolved][Severity: Critical][Web app exploit]

Nakabayashi: SQL injection on the Fuel Mall online shop put up to 120,000 customer records and 94 cards at risk

Attackers used SQL injection on the stationery shop Fuel Mall and rewrote its program; order and customer data and some card data may have leaked.

Disclosed

2020-04-13

Organizations involved

Leaked or at risk

120K

120,000

Downtime

Unknown

What happened

2020-04-10
Data processing on the site behaved suspiciously, so the site was closed and checked. Signs of SQL injection and of the processing program being rewritten by a rogue file were found. [1] [2]
2020-04-13
Public disclosure. At this point the company counted 5 leaked cards. [1]
2020-06-04
The card count was corrected to 94 customers who paid between 2020-04-06 and 2020-04-10. [3]

Impact

Up to 120,000 records of orders, buyers' names, addresses and email addresses, and recipients' names and addresses may have leaked. For cards, holder names, numbers, expiry dates and security codes were affected and may have been misused. [1] [3]