Kakiyasu Honten: the payment application of its online shop was tampered with, and card data of 1,293 customers may have leaked

1. 2020-10-13

   A credit card company told the firm that card data of customers who used the online shop seemed to be leaking. The same day it stopped card payments on the site and had a third-party firm investigate. [1] [2] [4]

2. 2020-12-07

   The investigation finished and confirmed that card data of customers who paid by card between April 29 and September 30 had leaked and some may have been misused. [1] [4]

3. 2020-12-17

   It reported to the Personal Information Protection Commission and filed a damage report with the Metropolitan Police. [1] [5]

4. 2021-01-19

   It disclosed the case and began writing to affected customers the same day. [1] [4]

The affected are 1,293 customers who paid by card during the period; the card holder name, number, expiry date and security code may have been stolen. The cause was a weakness in the site's system that let attackers tamper with the payment application. [1] [2] [4]

The firm is watching transactions on the possibly leaked cards with the card companies and asked them not to charge customers a reissue fee if they want a new card. It said the announcement took over three months because its payment agency advised it that announcing an uncertain situation would only cause confusion, so it waited for the investigation results and for the card companies. [1] [2]