[Resolved][Severity: Critical][Web app exploit]

Shin Nihon Kinou Shokuhin: unauthorized access to its wholesale site Kenko Oroshi.com may have leaked card data of 224 customers

Card details of 224 customers and 336 card numbers from payments between October 21, 2019 and October 9, 2020 may have leaked, and some may have been misused.

Disclosed

2021-02-25

Organizations involved

Leaked or at risk

224

Downtime

Unknown

What happened

2019-10-21
From this day, a third party exploiting a weakness in the site's system could get card data. [1] [4]
2020-10-09
A card company told the firm that card data of its customers seemed to be leaking. The same day it stopped card payments and had a third-party firm investigate. [1] [3]
2020-10-15
It reopened the site in a renewed form, but without card payments. [1] [3]
2020-11-20
The investigation finished and confirmed the leak of card data and possible misuse of some. [1] [3]
2021-02-01
It reported to the Personal Information Protection Commission. [1] [3]
2021-02-04
It filed a damage report with the police. [1] [3]
2021-02-25
Its parent Ishigaki Foods disclosed the case, and the firm began writing to affected customers by mail. [1] [2] [3]

Impact and the delay

The affected are 224 customers and 336 card numbers from card payments on Kenko Oroshi.com during the period, including the holder name, number, expiry date and security code. The site is a wholesale site for online sellers that handles health support food, cosmetics and sundries. [1] [2] [3]

The company explained that it waited for the investigation results and for cooperation with the card companies because announcing uncertain information would cause confusion. [1]