> JapanHacked_
[Resolved][Severity: Critical][Intrusion]

KitchHike: member data of its dining app leaked, up to 116,863 users

An outside expert flagged the leak. Attackers got into an external backup server, and names, email addresses, hashed passwords and phone numbers of up to 116,863 users leaked.

Disclosed

2020-07-24

Organizations involved

1

Leaked or at risk

116.9K

116,863

Downtime

Unknown

What happened

  1. An outside security expert warned the company of a suspected incident, and it began investigating the same day. [2]

  2. Users were emailed and asked to change their passwords. [2]

  3. New sign-ups were stopped. The same day the company reported the case to the police and IPA. [2]

  4. The whole service was stopped and the servers were replaced. [2]

  5. The replacement was finished and the service reopened. [2]

  6. Public disclosure. [1] [2]

  7. The third report put the number affected at up to about 117,000. [3]

  8. Final report: an external server holding backup data had been accessed without permission. [4]

Impact

Names, email addresses, hashed passwords and phone numbers of up to 116,863 users leaked. The service held no card data. [3] [4]

Timeline

  1. Detected 2020-07-16
  2. Disclosed 2020-07-24
  3. 8 days

Attack or cause

Method
[Intrusion]
Impact
[Data leak][Service outage]
Entry point
Unknown

Data exposed or at risk

[Name][E-mail address][Passwords][Phone number]

Services hit

Organizations involved

Open in organization search

Sources

  1. [1][News]グルメアプリに不正アクセスの可能性 - ユーザー情報流出かSecurity NEXT · 2020-07-29
  2. [2][News]不正アクセスでユーザー情報が流出、対策としてサーバリプレイスを実施（キッチハイク）ScanNetSecurity · 2020-07-30 08:00
  3. [3][News]グルメ情報サイト「キッチハイク」11万件超のユーザー情報流出かCybersecurity.com · 2020-08-20
  4. [4][News]食べ歩きアプリ会員情報の流出、バックアップデータを保存する外部サーバへの不正アクセスが判明（キッチハイク）ScanNetSecurity · 2020-09-03 08:00