[Resolved][Severity: Critical][Web app exploit]

Tatsumura Bijutsu Orimono: its online shop's payment module was tampered with, possibly leaking 941 credit card records and 793 login IDs and passwords

A vulnerability was exploited to tamper with the payment module, possibly leaking about eleven months of card data and other details.

Disclosed

2021-03-11

Organizations involved

Leaked or at risk

941

Downtime

Unknown

What happened

2019-11-25
From this day, card data and other details may have begun to be stolen through the tampered payment module. [1]
2020-10-28
The credit card payment processor pointed out a possible leak, and the problem came to light. [1]
2020-12-09
The company removed the program that caused it. [1]
2020-12-18
The company reported to the Personal Information Protection Commission. [1]
2020-12-23
The company reported to the police. [1]
2021-03-11
The company emailed the customers concerned to explain and apologize. [1]

Impact

Credit card data of 941 payments made between November 25, 2019 and October 28, 2020 (name, number, expiry date and security code) may have leaked. [1]