[Resolved][Severity: Major][Web app exploit]

The Westin Osaka: the payment application of the hotel's online shop was altered, and cards of up to 1,039 customers may have leaked

An intruder altered the payment application of the hotel's online shop, and card numbers and security codes used over about a year may have been stolen.

Disclosed

2020-08-28

Organizations involved

Leaked or at risk

1,039

Downtime

Unknown

What happened

2019-05-06
From this day to May 17, 2020, card data entered in the shop could be stolen. [1]
2020-05-29
A card company warned of a possible leak; card payments were stopped the same day and an outside investigation began. [1]
2020-07-22
The final report found that an intrusion into the system had altered the payment application. [1]
2020-08-17
The company consulted the Oyodo police station. [1]
2020-08-28
Public disclosure. [1]

Impact

Holder names, numbers, expiry dates and security codes of the cards of up to 1,039 customers who paid by card in that period may have leaked. The server holding names, addresses and other details showed no sign of a break-in. [1]