[Resolved][Severity: Critical][Web app exploit]

Gunma Tourism Association: the payment page of the CASA Gunma online shop was tampered with, and card data of 651 customers may have leaked

Attackers exploited a flaw and altered the payment code. From September 2019 to June 2020, 708 card records of 651 customers may have leaked, and some may have been misused.

Disclosed

2020-09-29

Organizations involved

Leaked or at risk

651

Downtime

Unknown

What happened

2019-09-12
From this day to June 2, 2020, card data of customers on the site could leak. [1]
2020-06-02
A card company raised the alarm, and card payments were stopped the same day. [1]
2020-06-05
The police were notified. [1]
2020-07-27
The outside investigation was completed. [1]
2020-09-29
Emails and letters to affected customers began. [1]