> JapanHacked_
[Resolved][Severity: Major][Intrusion]

iTEC: an intrusion into the iTEC Store for IT exam materials may have leaked four years of buyers' personal data

Repeated access from abroad on August 14 may have leaked names, addresses and purchases of everyone who bought from the store since June 2016. Cards and passwords were safe.

Disclosed

2020-08-19

Organizations involved

1

Leaked or at risk

Unknown

Downtime

Unknown

What happened

  1. The iTEC Store was accessed without permission several times from foreign IP addresses. [1] [2]

  2. The intrusion was found, outside access was restricted and the police were consulted. [2]

  3. Public disclosure; affected customers were informed by email. [2]

Impact

iTEC IDs, names, addresses, email addresses, phone numbers, items, amounts and payment methods of customers who bought from June 13, 2016 to August 14, 2020 may have leaked. For some, birth dates, genders, fax and mobile numbers and employers were included. Passwords and cards were not affected, and no count was given. [1] [2]

Timeline

  1. Started 2020-08-14
  2. Detected 2020-08-18
  3. Disclosed 2020-08-19
  4. 5 days

Attack or cause

Method
[Intrusion]
Impact
[Data leak]
Entry point
Web app

Data exposed or at risk

[Name][Postal address][E-mail address][Phone number][Purchase history][Date of birth][Gender][Employment]

Services hit

Organizations involved

Open in organization search

Sources

  1. [1][News]IT資格試験教材サイトに不正アクセス - 顧客情報流出の可能性Security NEXT · 2020-08-20
  2. [2][News]「アイテックストア」に不正アクセス、4年分の購入情報が流出の可能性（アイテック）ScanNetSecurity · 2020-08-21 08:00