> JapanHacked_
[Resolved][Severity: Critical][Web app exploit]

Magfine: a fake payment form on its magnet shop may have leaked 178 cards from 2018

A flaw in the shop's EC-CUBE software sent buyers to a fake payment form, and cards entered in 2018 may have been stolen. Disclosure came 16 months after discovery.

Disclosed

2020-05-18

Organizations involved

1

Leaked or at risk

178

178

Downtime

Unknown

What happened

  1. A card company alerted the shop. [2]

  2. An outside investigator finished its work. [2]

  3. Public disclosure; affected customers were contacted by email. The company said investigation and talks with the parties involved took time. [1] [2]

Impact

Numbers, expiry dates and security codes of 178 cards used for payment from to may have leaked and been misused. Customers who did not complete a payment are also affected if they typed their card into the fake form. [2]

Timeline

  1. Started 2018-10-05
  2. Detected 2019-01-25
  3. Disclosed 2020-05-18
  4. 591 days

Attack or cause

Method
[Web app exploit]
Impact
[Data leak][Fraud]
Entry point
Web app

Data exposed or at risk

[Payment card]

Services hit

Organizations involved

Open in organization search

Sources

  1. [1][News]セキュリティコード含むクレジットカード情報流出、EC-CUBE の脆弱性突かれ(マグファイン)ScanNetSecurity · 2020-05-20 08:00
  2. [2][News]2018年の通販サイト不正アクセスを公表 - 磁石専門店Security NEXT · 2020-05-20