> JapanHacked_
[Resolved][Severity: Critical][Web app exploit]

Mikazuki: its online shop was broken into, and up to 464 card records may have leaked

Card data entered at checkout from September 2019 to May 2020 may have been stolen.

Disclosed

2020-11-25

Organizations involved

1

Leaked or at risk

464

464

Downtime

Unknown

What happened

  1. From this day to May 25, 2020, card data entered on the site could be sent out. [1]

  2. A card company raised the problem and the site was stopped. [1]

  3. The outside investigation ended. [1]

  4. The company consulted the police. [1]

  5. It reported to the Personal Information Protection Commission. [1]

  6. It began notifying affected customers by mail. [1]

Impact

Up to 464 card records from payments between September 30, 2019 and May 25, 2020 may have leaked. [1]

Timeline

  1. Started 2019-09-30
  2. Detected 2020-06-29
  3. Disclosed 2020-11-25
  4. 422 days

Attack or cause

Method
[Web app exploit]
Impact
[Data leak]
Entry point
Web app

Data exposed or at risk

[Payment card][Name]

Services hit

Organizations involved

Open in organization search

Sources

  1. [1][News]新潟ご当地グルメの通販ショップに不正アクセスSecurity NEXT · 2020-11-25