[Resolved][Severity: Critical][Web app exploit]

Shogakukan Publishing Service: BOOK SHOP Shogakukan was broken into, and card data of 1,036 Gravure Club payments may have leaked

A system flaw was exploited and card numbers used for payments from April 2015 to June 2020 were taken from the database.

Disclosed

2020-11-16

Organizations involved

Leaked or at risk

1,036

Downtime

Unknown

What happened

2020-06-12
A card company pointed out a possible leak. [1]
2020-06-15
Card payments were stopped. [1]
2020-08-24
The outside investigation ended. [1]
2020-10-22
The company reported to the Personal Information Protection Commission and consulted the police. [1]
2020-11-16
It began apologizing to affected customers by mail and letter. [1]

Impact

Card data from 1,036 payments for the Gravure Club between April 13, 2015 and June 15, 2020 leaked, and some may have been misused. It includes the cardholder name, number, expiry date and security code. [1]