[Resolved][Severity: Critical][Web app exploit]

Bleu Claire: the payment application of its cosmetics online shop was tampered with, and credit card data of 1,863 people may have leaked and been misused

A vulnerability was exploited to tamper with the payment application. Card data of 1,863 people from about ten months may have leaked and been misused.

Disclosed

2021-05-24

Organizations involved

Leaked or at risk

1.9K

1,863

Downtime

Unknown

What happened

2020-03-30
From this day, card data may have begun to be stolen through the tampered payment application. [1] [2]
2021-01-29
A credit card company pointed out a concern about leaked card data. The shop stopped card payments that day and had a third-party body investigate. Card data used up to this day was affected. [1] [2]
2021-03-30
The investigation was completed and the report received. [1] [2]
2021-04-19
It reported the damage to the police. [1] [2]
2021-04-22
It reported to the Personal Information Protection Commission. [1] [2]
2021-05-24
It began apologizing to and informing the customers concerned by email. [1] [2]

Impact

The card names, numbers, expiry dates and security codes of 1,863 people who paid by card on the Bleu Claire website between March 30, 2020 and January 29, 2021 may have leaked and been misused. The company is monitoring transactions on the cards that may have leaked together with the card companies, and asked customers to check for charges they do not recognize. [1] [2]