[Resolved][Severity: Critical][Web app exploit]

Skytop Trading: the payment code of the CELL CELLAR official shop was altered, and customers' card data may have leaked

Attackers exploited a flaw and altered the payment code. Card data of 29 customers who paid on the site and 525 who bought by subscription or phone may have leaked.

Disclosed

2020-09-29

Organizations involved

Leaked or at risk

554

Downtime

Unknown

What happened

2020-04-07
The Tokyo police cybercrime unit warned the company of a possible card data leak. [1]
2020-04-08
Card payments were stopped and an outside investigation began. [1]
2020-09-29
Public disclosure. [1]

Impact

A flaw was exploited to alter the payment code, so card data may have leaked and some may have been misused. For 29 customers who paid on the site from December 2019 to April 2020, card data including the security code is affected; for 525 customers who ordered by subscription, phone, email or fax from August 2010 to April 2020, card data without the security code. [1] [2]