[Resolved][Severity: Critical][Web app exploit]

Green Forest: unauthorized access to its two pet food sites may have leaked card data of 417 customers

Card details of customers who paid by card between July 9, 2019 and July 30, 2020 may have leaked, and some may have been misused.

Disclosed

2021-02-19

Organizations involved

Leaked or at risk

417

Downtime

Unknown

What happened

2019-07-09
From this day, a third party exploiting a weakness in the sites' systems could get card data. [2] [3]
2020-07-30
A card company told the firm that card data of its customers seemed to be leaking. The same day it stopped card payments and had a third-party firm investigate. [2] [3]
2020-11-16
The investigation finished and confirmed the leak of card data and possible misuse of some. [2] [3]
2021-02-01
It reported to the Personal Information Protection Commission and filed a damage report with the Asahikawa-Higashi police station. [2] [3]
2021-02-12
It began writing to affected customers. [2] [3]
2021-02-19
The company disclosed the case. [1] [3]

Impact

The two sites are for pet owners of the Midori no Mori animal hospital that the company runs. The affected are 270 customers who paid by card on Mori no Otodokebin and 147 on Tetote, Pet no Gohan during the period, including the holder name, number, expiry date and security code. The firm is watching transactions on the possibly leaked cards with the card companies and asked customers to check their statements. [2] [3]