[Resolved][Severity: Critical][Web app exploit]

System Five: the payment processing program of its online shop was tampered with, and card data of up to 3,812 customers may have leaked

Card holder names, numbers, expiry dates and security codes entered between July 20 and October 27, 2020 may have been stolen.

Disclosed

2021-01-26

Organizations involved

Leaked or at risk

3.8K

3,812

Downtime

Unknown

What happened

2020-07-20 20:49
From around this time, a tampered payment program began forwarding newly entered card data to an outside party. [1] [2]
2020-10-27 13:47
The forwarding ended around this time. The same day the firm noticed the intrusion, stopped card payments and the whole site, and reported the damage to the police. [1] [2]
2020-10-29
It reported to the Personal Information Protection Commission. [1]
2020-12-04
A third-party investigation finished and found that card data may have leaked through the tampered payment program. [1] [2]
2021-01-26
The firm disclosed the case. [1] [2]

Impact and response

Up to 3,812 pieces of newly entered card data may have leaked. The logs also showed traces of unauthorized access to the server holding personal data, but no leak of personal data other than card data has been confirmed. [1] [2]

The firm is watching transactions on the cards concerned together with the card companies. It plans to discard the old system and reopen the shop on a new one, servers included; in the meantime it runs a temporary site on a different system. [1]