[Resolved][Severity: Critical][Web app exploit]

Zao Dairy Center: a fake payment form on the Zao Cheese Online Shop may have exposed the cards of 268 customers

Attackers exploited a flaw in the cheese online shop and sent buyers to a fake payment form, putting about seven months of card data at risk.

Disclosed

2020-04-06

Organizations involved

Leaked or at risk

268

Downtime

Unknown

What happened

2019-12-03
A customer contacted the foundation, worried that their card data had leaked. Card payment on the site was stopped the next day. [1]
2020-02-28
An outside investigator finished its work: unauthorized access through a flaw in the site had leaked card data, and some cards may have been misused. [1]
2020-03-12
The foundation reported to the Personal Information Protection Commission and filed a report with the police. [1]
2020-04-06
Public disclosure. [1]

Impact

Cardholder names, numbers, expiry dates and security codes of 268 customers who may have entered their cards on a fake payment form between 2019-04-25 and 2019-12-04 may have leaked. [1] [2]