> JapanHacked_
[Resolved][Severity: Critical][Intrusion]

Kansai Airports Retail Service: the pre-departure reservation site of its Kansai International Airport duty-free shops was accessed without authorization, possibly leaking data on up to 31 lottery winners

The winner confirmation pages of its reservation site were accessed without authorization, possibly leaking names and emails of up to 31 winners.

Disclosed

2021-04-27

Organizations involved

1

Leaked or at risk

Unknown

Downtime

Unknown

What happened

  1. From around this time, some pages of the reservation site were accessed without authorization. [1]

  2. The access lasted until around this time. [1]

  3. The company confirmed that the site might have been accessed without authorization, stopped the site and began investigating. [1]

Impact

The access hit the winner confirmation pages of a lottery sale of aged Japanese whisky, published on the Japanese and Chinese versions of the mobile and PC sites. The names, email addresses, departure times, flights and winning products of up to 31 winners may have leaked. The company said it would contact each person concerned. [1]

Kansai Airports, the point of contact, told the reporter that the case was under investigation and it could not give details, so the cause and the effect on other services remained unclear. [1]

Timeline

  1. Started 2021-03-11
  2. Detected 2021-04-16
  3. Disclosed 2021-04-27
  4. 47 days

Attack or cause

Method
[Intrusion]
Impact
[Data leak]
Entry point
Web app

Data exposed or at risk

[Name][E-mail address]

Services hit

Organizations involved

Open in organization search

Sources

  1. [1][News]関西エアポート関連サイトに不正アクセス - 個人情報流出の可能性Security NEXT · 2021-04-27