Magfine: a fake payment form on its magnet shop may have leaked 178 cards from 2018
A flaw in the shop's EC-CUBE software sent buyers to a fake payment form, and cards entered in 2018 may have been stolen. Disclosure came 16 months after discovery.
Disclosed
2020-05-18
Organizations involved
1
Leaked or at risk
178
178
Downtime
Unknown
What happened
Impact
Numbers, expiry dates and security codes of 178 cards used for payment from to may have leaked and been misused. Customers who did not complete a payment are also affected if they typed their card into the fake form. [2]
Timeline
- Started 2018-10-05
- Detected 2019-01-25
- Disclosed 2020-05-18
- 591 days
Attack or cause
- Method
- [Web app exploit]
- Impact
- [Data leak][Fraud]
- Entry point
- Web app
Data exposed or at risk
Services hit
Organizations involved
[Breached][Critical]Saitama, KoshigayaManufacturing178 leaked
Magfine Corporation
Sources
- [1][News]セキュリティコード含むクレジットカード情報流出、EC-CUBE の脆弱性突かれ(マグファイン)ScanNetSecurity · 2020-05-20 08:00
- [2][News]2018年の通販サイト不正アクセスを公表 - 磁石専門店Security NEXT · 2020-05-20