[Resolved][Severity: Critical][Web app exploit]

Enjin: an intrusion into its forestry machinery shop ENGINE may have leaked 932 payment cards

Attackers used a flaw in the forestry machinery shop, and card numbers and security codes used from October to December 2019 may have been stolen. Some may have been misused.

Disclosed

2020-07-17

Organizations involved

Leaked or at risk

932

Downtime

Unknown

What happened

2019-10-13
From this day, card data entered on the site could be stolen. [1]
2020-01-21
A card company warned of a possible leak; card payments were stopped and an outside investigation began. [1]
2020-03-25
The investigation finished and found that an intrusion through a flaw in the system was the cause. [1]
2020-06-01
The company reported to the Ministry of Economy, Trade and Industry and the Personal Information Protection Commission and filed a police report. [1]
2020-07-17
Affected customers began to be informed by email. [1]

Impact

Holder names, numbers, expiry dates and security codes of 932 cards used from October 13 to December 19, 2019 may have leaked, and some may have been misused. [1]