[Resolved][Severity: Critical][Web app exploit]

Kitamura Japan: an intrusion into its pillow shop may have leaked 44 cards and data of 5,589 registered customers

Attackers used a flaw in the pillow maker's online store. Card data may have been stolen, and data of past registered customers sat on the server where it could be reached.

Disclosed

2020-07-30

Organizations involved

Leaked or at risk

5.6K

5,589

Downtime

Unknown

What happened

2019-10-25
From this day, card data and registered customer data could be stolen. [1]
2020-01-07
A check of the site's flaws showed it may have been accessed without permission. Card payments were stopped the next day and work on a new site began. [2]
2020-05-14
A card company warned of a possible leak; the site was stopped the same day and an outside investigation began. [1] [2]
2020-06-15
The investigation finished and found that a flaw in the system had been attacked. [1]
2020-07-30
Public disclosure. [2]

Impact

Holder names, numbers, expiry dates and security codes of the cards of 44 customers who paid by card from October 25, 2019 to January 7, 2020 may have leaked. [1] [2]

Names, addresses, phone numbers and, for some, gender, birth dates, email addresses and fax numbers of 5,589 past registered customers could also be taken from October 25, 2019 to May 22, 2020. With no access logs left, the company could not tell whether they were actually taken. [1]