Kansai Airports Retail Service: the pre-departure reservation site of its Kansai International Airport duty-free shops was accessed without authorization, possibly leaking data on up to 31 lottery winners
The winner confirmation pages of its reservation site were accessed without authorization, possibly leaking names and emails of up to 31 winners.
Disclosed
2021-04-27
Organizations involved
1
Leaked or at risk
Unknown
Downtime
Unknown
What happened
Impact
The access hit the winner confirmation pages of a lottery sale of aged Japanese whisky, published on the Japanese and Chinese versions of the mobile and PC sites. The names, email addresses, departure times, flights and winning products of up to 31 winners may have leaked. The company said it would contact each person concerned. [1]
Kansai Airports, the point of contact, told the reporter that the case was under investigation and it could not give details, so the cause and the effect on other services remained unclear. [1]
Timeline
- Started 2021-03-11
- Detected 2021-04-16
- Disclosed 2021-04-27
- 47 days
Attack or cause
- Method
- [Intrusion]
- Impact
- [Data leak]
- Entry point
- Web app
Data exposed or at risk
Services hit
Organizations involved
[Breached][Critical]Osaka, IzumisanoWholesale and retail trade31 leaked
Kansai Airports Retail Service Co., Ltd.
Sources
- [1][News]関西エアポート関連サイトに不正アクセス - 個人情報流出の可能性Security NEXT · 2021-04-27