[Resolved][Severity: Critical][Web app exploit]

Planet: the payment application of its perfume online shop Kousui Gakuen was tampered with, and credit card data of 2,821 people may have leaked and been misused

A system vulnerability was exploited to tamper with the payment application. Card data of 2,821 people from about eleven months may have leaked and been misused.

Disclosed

2021-05-19

Organizations involved

Leaked or at risk

2.8K

2,821

Downtime

Unknown

What happened

2020-02-24
From this day, card data may have begun to be stolen through the tampered payment application. [1] [2]
2021-01-08
A credit card company told the shop of a concern about leaked card data. It stopped card payments that day and had a third-party body investigate. Card data used up to this day was affected. [1] [2]
2021-02-28
The outside investigator finished its work. [1] [2]
2021-04-28
It reported to the Personal Information Protection Commission and reported the damage to the police. [1] [2]
2021-05-19
It announced the case and began contacting the customers concerned individually by email and letter. [1] [2]

Impact

The credit card data (name, number, expiry date and security code) of 2,821 people whose cards were newly registered or changed on the site and then used for payment between February 24, 2020 and January 8, 2021 may have leaked and been misused. People who paid with an already registered card were not affected. The log investigation also showed unauthorized access to the server that holds personal data other than cards. [1] [2]