[Resolved][Severity: Critical][Web app exploit]

Toei Video: an intrusion into the Toei Video online shop may have leaked card data of 10,021 customers

Attackers exploited a flaw in the shop, and 10,395 card records of up to 10,021 customers who paid from May 2019 to May 2020 may have leaked.

Disclosed

2020-09-30

Organizations involved

Leaked or at risk

10K

10,021

Downtime

Unknown

What happened

2019-05-27
From this day to May 11, 2020, there were traces of intrusions through a flaw in the system. [1]
2020-05-11
A card company, through the payment processor, warned of a possible leak, and all services of the shop were stopped. An outside investigation was ordered the same day. [1]
2020-05-29
The investigation ended. It found traces of intrusion, but no tampering or malicious program for stealing card data. [1] [2]
2020-06-16
The police were notified. [1]
2020-06-25
The Personal Information Protection Commission was notified. [1]
2020-09-30
Public disclosure; notices to affected customers began. [1]

Impact

Card companies pointed to 10,395 card records of up to 10,021 customers who paid by card in the period (holder name, number, expiry date and security code) as possibly leaked. No other personal data was found to be affected. [1]

Delay and response

The company apologized for the delay, saying it had differed with the card companies on whether data leaked and talks took time. The old system was discarded, and the shop was to reopen on new servers with stronger monitoring. [1] [2]