[Resolved][Severity: Critical][Web app exploit]

hues: an unauthorized access to its menswear shop HUES ONLINE may have leaked card data of 536 customers

Card details of 536 customers who paid by card between February 9 and October 14, 2020 may have leaked, and some may have been misused.

Disclosed

2021-02-17

Organizations involved

Leaked or at risk

536

Downtime

Unknown

What happened

2020-02-09
From this day, a third party exploiting a weakness in the site's system could get card data. [2] [3]
2020-10-15
A card company told the firm that card data of its customers seemed to be leaking. The same day it stopped card payments and had a third-party firm investigate. [3]
2020-11-30
The investigation finished and confirmed the leak of card data and possible misuse of some. [2] [3]
2020-12-14
It filed a damage report with the Fukuoka Chuo police station. [3]
2021-01-08
It reported to the Personal Information Protection Commission. [2] [3]
2021-02-17
The company disclosed the case and began writing to affected customers by mail. [1] [2] [3]

Impact

The affected are 536 customers who paid by card on HUES ONLINE during the period, including the holder name, number, expiry date and security code. The firm is watching transactions on the possibly leaked cards with the card companies and asked customers to check their statements. [2] [3]