[Resolved][Severity: Critical][Web app exploit]

ANTRAC: intrusion into the PC parts shop OVERCLOCK WORKS may have leaked credit card data of 714 customers

Card data of customers who paid by card from June 2019 to July 2020 was taken. The firm stopped card payments in July and announced in December after the investigation.

Disclosed

2020-12-23

Organizations involved

Leaked or at risk

714

Downtime

Unknown

What happened

2019-06-18
Card data of customers who paid by card from this day to July 3, 2020 may have leaked. [1] [2]
2020-07-03
Card companies pointed out that card data of customers of the shop might have leaked, and the firm stopped card payments. [1] [2]
2020-09-15
An outside investigation ended and found a weakness in the system and signs it had been exploited. [1]
2020-11-27
The firm reported the damage to the police. [1]
2020-12-04
It reported to the Personal Information Protection Commission. [1]
2020-12-23
The firm disclosed the case and began notifying customers by mail and letter. [1] [2]

Impact and response

The affected are 714 people who paid by card between June 18, 2019 and July 3, 2020. The card holder name, number, expiry date and security code may have leaked, and some may have been misused. [1] [2]

On the delay, the firm said that after consulting the card companies it judged that publishing uncertain information would only cause confusion, so it waited for the findings and for coordination with them. [2]