Isetan Mitsukoshi: password list attacks on its online store and the MI Card site may have exposed data of about 54,000 people

1. 2020-05-05

   An outside forensic review later found the logins to the online store had begun on this day. [3]

2. 2020-07-06

   From this day to August 3, logins from foreign IP addresses used customers' own IDs and passwords to pose as them. The first notice gave this period for both sites. [1] [2]

3. 2020-08-06

   Members reported login notices they did not recognize; checks found the attack, and the company disclosed it. [2]

4. 2020-09-14

   The company published the review: online store members whose data may have been seen rose to 50,285. No new logins were found on the MI Card site. [3]

The company reset the passwords of newly found victims and asked them to set new ones. It blocked the attacking IP addresses, added equipment and reviewed settings. [3]