[Resolved][Severity: Critical][Web app exploit]

CINRA: a fake payment form on the CINRA.STORE online shop may have stolen card data of 337 customers

Attackers exploited a flaw in the shop, and from December 2019 to May 2020 a fake payment form collected card details.

Disclosed

2020-09-23

Organizations involved

Leaked or at risk

337

Downtime

Unknown

What happened

2019-12-12
From this day to May 29, 2020, a fake payment form could steal card details. [1]
2020-05-26
A card company warned of a possible leak, and card payments were stopped the same day. [1]
2020-07-06
The outside investigation was completed. [1]
2020-09-23
Emails to affected customers began. [1]

Impact

Card holder names, numbers, expiry dates and security codes of 337 customers who paid may have leaked, as may details typed into the fake form by people who did not finish paying. The shop had already announced its closing at the end of May and will not reopen. [1]