[Resolved][Severity: Critical][Web app exploit]

Kyo Tsukimachian: its online shop's payment application was tampered with, possibly leaking 943 credit card records from about two years and four months

A vulnerability was exploited to tamper with the payment application, possibly leaking card data from June 2018 to October 2020.

Disclosed

2021-03-15

Organizations involved

Leaked or at risk

943

Downtime

Unknown

What happened

2018-06-06
From this day, card data may have leaked through the tampered payment application. [1] [3]
2020-10-05
A card company pointed out a possible leak. The same day the shop stopped card payments and began an investigation. [1] [3]
2020-11-16
The company filed a report with the police. [1]
2020-12-11
An outside investigator finished its work and confirmed the payment application had been tampered with. [1] [3]
2021-02-05
The company reported to the Personal Information Protection Commission. [1]
2021-03-15
The company announced the case and emailed the customers concerned. [1] [2] [3]

Impact

The name, number, expiry date and security code of 943 customers who paid by card between June 6, 2018 and October 5, 2020 may have leaked. [1] [3]