[Resolved][Severity: Critical][Web app exploit]

JAOS: intrusion into the JAOS online shop may have leaked credit card data of 368 customers

Card data used from March 2017 to April 2018 was taken. Card companies flagged it in February 2019, and the announcement came about 600 days after the investigation.

Disclosed

2020-12-15

Organizations involved

Leaked or at risk

368

Downtime

Unknown

What happened

2017-03-31
Card data of customers who paid by card from this day until April 17, 2018 leaked. [1] [2]
2019-02-08
Some card companies reported fears of a card data leak among customers of the shop, and the company stopped card payments the same day. [1]
2019-04-30
An outside forensic investigation ended and confirmed the cause as unauthorized access through a weakness in the system. [1] [2]
2019-12-11
The company reported the damage to the police. [1]
2020-09-29
It reported to the Personal Information Protection Commission. [1]
2020-12-15
The company disclosed the case. [1] [2]

Impact

The card holder name, number, expiry date and security code of 368 customers who paid by card from March 31, 2017 to April 17, 2018 may have leaked, and some may have been misused. The company is watching transactions with the card companies and asks customers to check statements for charges they do not recognize. Card payment at the online shop remains suspended. [1] [2]