[Resolved][Severity: Critical][Web app exploit]

Ace Sangyo Kiki: the payment application of its Douguyasan Honten shop was altered, and cards of 82 customers may have leaked

Attackers altered the shop's payment application through a flaw, and card data entered from September 2019 to February 2020 may have been stolen. Disclosure came five months later.

Disclosed

2020-06-30

Organizations involved

Leaked or at risk

Downtime

Unknown

What happened

2019-09-10
From this day, card data entered in the shop could be stolen. [1]
2020-02-05
A card company warned of a possible leak; card payments were stopped the same day and an outside investigation began. [1]
2020-04-24
The investigation finished and found that an intrusion through a flaw in part of the system had altered the payment application. [1] [3]
2020-05-14
The company reported the crime to the Nagahama police station in Shiga and reported to the Personal Information Protection Commission the next day. [1]
2020-06-30
Public disclosure; affected customers began to be informed by email. [1] [2]

Impact

Holder names, numbers, expiry dates and security codes of cards used by 82 customers from September 10, 2019 to February 5, 2020 may have leaked, and some may have been misused. The opening of the notice gave 86 records. [1] [2]

Response

The company said it had waited, after talking with its payment provider, for the investigation results and coordination with the card companies before going public. It asked card companies not to charge customers for replacement cards and said it would announce when the shop reopened. [1]