[Resolved][Severity: Critical][Web app exploit][Misconfiguration]

Yoshihara Systems: the new system of its home-delivery cleaning service Sentakubin was hit by SQL injection and old-system data sat open to outsiders, so card data of up to 58,813 people may have leaked

SQL injection put 44,891 records at risk and old-system data left open exposed 13,922 more, so up to 58,813 card records may have leaked.

Disclosed

2021-04-05

Organizations involved

Leaked or at risk

58.8K

58,813

Downtime

Unknown

What happened

2020-04-27
The new system went live. From the same day, data on some customers from the old system, kept on a server for development during the migration, sat in a public area and could be accessed from outside. [1]
2020-10-30
A credit card company pointed out a possible leak, and the company stopped credit card payments the same day. [1]
2020-11-16
The company made the exposed data inaccessible. [1]
2021-01-26
The company reported to the police. [1]
2021-01-30
The company reported to the Personal Information Protection Commission. [1]
2021-04-05
The company began contacting the customers whose data may have leaked by email. [1]

Impact

The new system, running since April 27, 2020, stored card data as tokens, but an unauthorized access exploiting an SQL injection flaw put the card data of 44,891 members who registered or changed their details at risk of leaking. [1]

Separately, data on 13,922 customers from the old system could be viewed from outside. Traces were found in the logs, but the number of records actually accessed is unknown. All of it included card holder names, numbers and expiry dates, and no leak of information other than card data, such as addresses, emails, IDs and passwords, has been confirmed. [1]

In the home-delivery service Meister Sentakubin of the cleaner Hakueisha, which used the same company's system, card data of 14 customers may also have leaked, and the same measures were taken. The company asked customers to watch for charges they do not recognize. [1]