[Resolved][Severity: Critical][Web app exploit]

Shimada Seishoku: an intrusion into the hatsutoki ONLINE STORE may have leaked the cards of 138 customers

Attackers used a flaw in the online store of the hatsutoki clothing brand, and card data used from December 2018 to January 2020 may have been stolen.

Disclosed

2020-07-13

Organizations involved

Leaked or at risk

138

Downtime

Unknown

What happened

2018-12-25
From this day, card data entered in the store could be stolen. [1]
2020-02-25
A card company warned of a possible leak. Card payments were stopped the next day and an outside investigation began. [1]
2020-04-14
The investigation finished and found that an intrusion through a flaw in the system was the cause. [1]
2020-07-13
Public disclosure. [1]

Impact

Holder names, numbers, expiry dates and security codes of the cards of 138 customers used from December 25, 2018 to January 22, 2020 may have leaked, and some may have been misused. [1]