[Resolved][Severity: Critical][Web app exploit]

Yutori no Kukan: its online shop was tampered with through a vulnerability, and 5,009 member records and 4,509 credit card records may have leaked

The sign-up page and payment screen were tampered with. Data on 5,009 new members and 4,509 card records may have leaked.

Disclosed

2021-03-31

Organizations involved

Leaked or at risk

5,009

Downtime

Unknown

What happened

2020-12-08
From this day, an unauthorized access exploiting a system vulnerability tampered with the new member sign-up page and the payment screen, and the information entered began to be stolen. [1] [2]
2021-01-27
A user asked about how pages moved, and the company noticed a possible tampering. It stopped credit card payments from the same day and investigated with the help of an outside firm. [1] [2]
2021-03-09
An outside firm gave an interim report pointing out that the new member sign-up page was tampered with. The company fixed the page. [1]
2021-03-15
The company was told about a possible leak. [1]
2021-03-29
The company reported to the police and the Personal Information Protection Commission. A survey report the same day also showed that the payment screen had been tampered with and a malicious program had been installed that sent card data typed into the form to outside. [1] [2]
2021-03-31
The company announced the possible leak of member data. It apologized by email to the customers concerned and advised them to change their passwords. [1]
2021-04-07
The company reported the possible leak of card data to the police and the Personal Information Protection Commission. [2]
2021-04-21
The company began sending apology and warning emails to the customers whose card data may have leaked. [2]

Impact

The data of 5,009 members newly registered on the site between December 8, 2020 and March 9, 2021 may have leaked. It includes names, addresses, phone numbers, email addresses, genders, birth dates, passwords and password hints. [1]

Credit card data for 4,509 registrations or payments made between December 8, 2020 and January 26, 2021 (name, number, expiry date and security code) may also have leaked. [2]

The company asked customers who reuse the password on other sites to change it. The site is the official site of the cooking experts Harumi Kurihara and Shimpei Kurihara, and the operator is a subsidiary of Mobcast Holdings. [1] [2]