> JapanHacked_
[Resolved][Severity: Major][Intrusion]

Hokkoku Management: its online mall COREZO was accessed without authorization, and data of 73 customers in the order database may have been viewed

Between 15:00 and 18:00 on February 3, customer data in the product order database server may have been viewed. The system stored no card data.

Disclosed

2021-02-15

Organizations involved

1

Leaked or at risk

73

73

Downtime

Unknown

What happened

  1. From this time until 18:00, a third party accessed the COREZO system without authorization. The contractor that maintains the site found traces of the access the same day. [1] [2]

  2. A third-party firm began an investigation. [1] [2]

  3. The company contacted the affected customers by mail and phone. [1] [2]

  4. It confirmed the safety of the site and reopened COREZO. [1] [2]

  5. Its parent Hokkoku Bank disclosed the case. [2]

Impact

The data that may have been viewed are the addresses, names, birth dates, occupations, genders, mail addresses, phone numbers and purchase information of 73 customers. The company said no card data leaked because the system does not hold it, and declined to disclose the cause. [1] [2]

The company said it would strengthen its security measures and monitoring based on the results. [2]

Timeline

  1. Started, Detected 2021-02-03
  2. Disclosed 2021-02-15
  3. 12 days

Attack or cause

Method
[Intrusion]
Impact
[Data leak]
Entry point
Unknown

Data exposed or at risk

[Name][Date of birth][Gender][Phone number][E-mail address][Postal address][Employment][Purchase history]

Services hit

Organizations involved

  • [Breached][Major]Ishikawa, KanazawaWholesale and retail trade73 leaked

    COREZO Co., Ltd.

    The company was then named Hokkoku Management Co., Ltd. and was a subsidiary of Hokkoku Bank.

Open in organization search

Sources

  1. [1][News]北國銀行子会社運営の通販モールに不正アクセスSecurity NEXT · 2021-02-16
  2. [2][News]ECモール「COREZO」に不正アクセス、データベースサーバから顧客情報閲覧の可能性ScanNetSecurity · 2021-02-17 08:00