> JapanHacked_
[Resolved][Severity: Major][Credential abuse]

Jupiter Shop Channel: credential stuffing on the Shop Channel site got into 264 accounts

Logins from abroad with credentials obtained elsewhere got into 264 accounts on the TV shopping site. In 22, names, addresses and last four card digits may have been viewed.

Disclosed

2020-07-22

Organizations involved

1

Leaked or at risk

264

264

Downtime

Unknown

What happened

  1. Monitoring found abnormal access from outside Japan, and checks showed login attempts that day. The company said the IDs and passwords came from elsewhere and found no sign of a leak from its own systems. [1]

  2. Public disclosure. [1]

Impact

264 accounts were logged into. In 22 of them, names, addresses, phone numbers, birth dates, email addresses, the last four digits and expiry dates of cards, and delivery details may have been viewed. [1]

Timeline

  1. Detected 2020-07-15
  2. Disclosed 2020-07-22
  3. 7 days

Services hit

Organizations involved

Open in organization search

Sources

  1. [1][News]通販サイト「ショップチャンネル」にPWリスト攻撃Security NEXT · 2020-07-28