> JapanHacked_
[Resolved][Severity: Critical][Web app exploit]

Ishiguro: the payment applications of its two fishing tackle online shops were tampered with, possibly leaking 4,026 credit card records of 3,171 people, which may have been misused

A vulnerability was exploited to tamper with the payment applications. Card data from about five months, 4,026 records, may have leaked and been misused.

Disclosed

2021-04-07

Organizations involved

1

Leaked or at risk

4K

4,026

Downtime

Unknown

What happened

  1. From this day, card data may have begun to be stolen through the tampered payment applications. [1]

  2. Card data used up to this day was affected. [1]

  3. A credit card company pointed out a possible leak, and the problem came to light. [1]

  4. The investigation was completed. [1]

  5. The company consulted the police about the damage and reported to the Personal Information Protection Commission. [1]

  6. The company began reporting and apologizing to the customers concerned by letter. [1]

Impact

Credit card data of 3,171 customers, 4,026 records (name, number, expiry date, security code and more), used at the two shops between May 27 and October 22, 2020 may have leaked and been misused. [1]

The company asked the customers concerned to check for charges they do not recognize. [1]

Timeline

  1. Started 2020-05-27
  2. Detected 2020-11-06
  3. Disclosed 2021-04-07
  4. 315 days

Attack or cause

Method
[Web app exploit]
Impact
[Data leak]
Entry point
Web app

Data exposed or at risk

[Payment card][Name]

Services hit

Organizations involved

Open in organization search

Sources

  1. [1][News]複数の釣り具通販サイトに不正アクセス - クレカ情報流出かSecurity NEXT · 2021-04-07