[Resolved][Severity: Critical][Web app exploit]

DesignX: the payment page of its business-to-business shop ApparelX was tampered with, possibly leaking 195 credit card records

A flaw in the upload function was exploited, and a fake input form sent card data to an outside site.

Disclosed

2021-03-29

Organizations involved

Leaked or at risk

195

Downtime

Unknown

What happened

2020-11-27
From this day, a fake card input form on the payment page sent entered data to an outside site. [1] [2]
2020-12-09
The in-house IT team noticed the tampering with the payment page and deleted the attack file. [1] [2]
2020-12-10
The company notified the police. [1] [2]
2020-12-16
On the payment processor's instruction, the company stopped card payments. [1] [2]
2021-03-08
The outside investigator finished its work. [1] [2]
2021-03-16
The company reported to the Personal Information Protection Commission. [1] [2]
2021-03-29
The company announced the case and emailed the customers concerned. [1] [2]

Impact

The card numbers, expiry dates and security codes of 195 customers who paid by card between November 27 and December 9, 2020 may have leaked, together with shipping names, email addresses, addresses and phone numbers. [1] [2]

The company explained that publication was delayed because, after consulting the payment processor, it decided to wait for the investigation results and coordination with card companies. [1]