[Resolved][Severity: Critical][Web app exploit]

Miyazaki Hideji Beer: a fake card entry screen on the Hideji Beer online shop may have leaked card data of 1,181 customers

Attackers exploited a flaw so that a fake card entry screen appeared at checkout. Card data of 1,181 customers from June 2019 to July 2020 may have leaked, and the shop was closed.

Disclosed

2020-09-15

Organizations involved

Leaked or at risk

1.2K

1,181

Downtime

Unknown

What happened

2019-06-05
From this day to July 3, 2020, a fake card entry screen appeared at checkout, even after card payments had been stopped. [1] [2]
2020-06-23
A card company warned of a possible leak; card payments were stopped the next day. [1] [2]
2020-08-18
The investigation was completed and the police were notified. [1] [2]
2020-09-15
Public disclosure; emails and letters to affected customers began. [1] [2]

Impact and response

Card holder names, numbers, expiry dates and security codes of 1,181 customers may have leaked. The number of people who typed into the fake screen without buying is unknown. Judging that the system could not be made safe, the brewery closed its own shop and now sells only through an online mall. [1] [2]