[Resolved][Severity: Critical][Web app exploit]

Ijindo: the payment application of its castella online shop was tampered with, possibly leaking 738 credit card records of 709 people, which may have been misused

A vulnerability was exploited to tamper with the payment application. Card data from about a year, 738 records, may have leaked and been misused.

Disclosed

2021-04-12

Organizations involved

Leaked or at risk

738

Downtime

Unknown

What happened

2019-11-29
From this day, card data may have begun to be stolen through the tampered payment application. [1]
2020-11-20
A credit card company pointed out a leak, and the problem came to light. The year up to this day was affected. [1]
2021-02-26
The investigation was completed. [1]
2021-03-01
The company reported the damage to the police. [1]
2021-03-02
The company reported to the Personal Information Protection Commission. [1]
2021-04-12
The company began explaining and apologizing to the customers concerned by email and letter. [1]

Impact

Credit card data of 709 customers, 738 records (name, number, expiry date, security code and more), used at the site between November 29, 2019 and November 20, 2020 may have leaked and been misused. People who entered card data are affected even if they did not complete an order. [1]

The company asked the customers concerned to check their card statements for charges they do not recognize. [1]