IVY C.S.: the Tokyo Woman's Christian University Co-op Web Shop may have been accessed without authorization, exposing up to 944 personal records and up to 162 cards, plus up to 50 cards on IVYCS FEE PAYMENT

1. 2020-05-12

   A credit card company told the company that card data seemed to be leaking from its Aoyama Gakuin co-op shop site. [1]

2. 2020-05-13

   It stopped payments and began investigating the Tokyo Woman's Christian University Co-op Web Shop and IVYCS FEE PAYMENT (Aoyama Gakuin fees), which it also runs. [1]

3. 2020-06-29

   The Web Shop investigation finished. A follow-up investigation then showed that member data and other information could be reached. [1] [2]

4. 2020-08-31

   It reported to the Personal Information Protection Commission and filed a damage report with the Shibuya police. [2]

5. 2021-01-18

   It disclosed the case and began mailing Web Shop users. [1] [2]

At the Web Shop, up to 944 records may have been viewed: 367 members who registered and 577 customers who ordered between March 4, 2017 and September 16, 2020. They include names, gender, birth dates, addresses, phone and fax numbers, mail addresses, occupations and company names. [1] [2]

For cards, the name, number, expiry date and security code of up to 162 people who paid by card between June 25, 2019 and May 12, 2020 may have leaked. The site did not store card data, but after talks with the card companies the company judged that a program sending customers to a fake payment form could not be ruled out. No trace of such a program was found on this site. [1] [2]

For IVYCS FEE PAYMENT, the company had announced on October 8, 2020 that 50 member records and 91 payment records may have leaked. It now added that up to 50 cards may also have leaked. It had at first denied unauthorized access to card data but chose to issue a warning after talks with the card companies. [1]