[Resolved][Severity: Critical][Web app exploit]

Tsuyuki: the Futon no Tsuyuki online shop was accessed without authorization, possibly leaking up to 19,197 card records, of which 1,784 were real completed payments

A system vulnerability was exploited and card data may have leaked. Most of it is believed to come from automated checks of whether cards work.

Disclosed

2021-03-23

Organizations involved

Leaked or at risk

19.2K

19,197

Downtime

Unknown

What happened

2019-12-03
From this day, card data may have leaked through unauthorized access. [1] [3]
2020-12-07
Some card companies pointed out a possible leak. The same day the shop stopped card payments and began an investigation. [1] [3]
2021-01-16
The company filed a report with the police. [1]
2021-01-27
The outside investigator finished its work. [1] [2]
2021-01-28
The company reported to the Personal Information Protection Commission. [1]
2021-03-23
The company announced the case and informed by letter the customers behind the 1,784 completed payments. [1] [2] [3]

Impact

Card data of up to 19,197 payments made between December 3, 2019 and December 7, 2020 (name, number, expiry date and security code) may have leaked. [1] [3]

Most of it is believed to be automated attempts to test generated card numbers on the site; the orders with completed payment numbered 1,784. [1] [2]