LDH JAPAN: the payment program of its EXILE TRIBE STATION ONLINE SHOP was tampered with, and card data of 44,663 people may have leaked

1. 2020-08-18

   From this day to October 15, a third party altered the payment processing program and card data newly registered or changed was taken. [1] [2]

2. 2020-10-15

   Some card companies reported fears that customers' card data from the site had leaked, and the company shut the site the same day and hired P.C.F.FRONTEO to investigate. [1] [2]

3. 2020-10-23

   It reported to the Personal Information Protection Commission and the police. [1] [2]

4. 2020-11-17

   The investigation ended and confirmed the card data leak and possible misuse of some cards. [1] [2]

5. 2020-11-27

   Card companies reported that at least 209 cards might have been misused. [1] [2]

6. 2020-12-08

   The company disclosed the case and began notifying affected customers by mail. [1] [2]

The affected are 44,663 people who newly registered a card or changed a registered card number at the site in the period; the card holder name, number, expiry date and security code may have leaked. Customers who paid with a saved card are not affected. The company did not store card data in its systems, but the payment processing program was rewritten and the data was taken. [1] [2]

The investigation confirmed that a server holding personal information was also accessed, but could not establish how many records leaked. No leak other than the card data has been confirmed. The site ran fully apart from the other LDH group sites, which were not affected. [1] [2]

On the delay, the company said that after talking with the card companies it judged that announcing before the facts were clear would cause confusion, so it waited for the findings and for coordination with them. It will scrap the current system and move to a new one. [1]