Mercari: credentials were stolen through a tampered development tool, Codecov, and part of its source code and information on 27,927 customers, business partners and employees leaked

1. 2021-01-31

   From this day, a third party periodically altered a script of the code coverage tool Codecov. [1]

2. 2021-04-13

   From this day until April 18, unauthorized access to GitHub with stolen credentials was concentrated. It had also happened several times since January 31. [1]

3. 2021-04-15

   The company behind Codecov announced the unauthorized access. [1]

4. 2021-04-16

   Mercari began revoking and replacing the credentials in its CI environment. [1]

5. 2021-04-23

   GitHub told it that part of its source code might have been affected, and its investigation showed unauthorized access to the source code. It set up a task force and reported to the authorities. [1] [2]

6. 2021-04-27

   It found that the source code that was accessed held customer information. Because attempts at unauthorized access from outside continued, it did not announce at once and put countermeasures first. [1] [2]

7. 2021-05-21

   It completed the initial investigation and announced the case. [1] [2] [3]

8. 2021-07-14

   Mobility Technologies announced the effect of the unauthorized access to Codecov on it. Names and email addresses of 757 employees of partners, and names and phone numbers of 86 employees of partners and its own, leaked. [6]

9. 2021-08-06

   It finished an investigation with an outside specialist and announced that 38 more records had leaked. [5]

The Codecov Bash uploader script was altered, so credentials, tokens and code reachable from users' CI environments could be sent to destinations chosen by the attacker. Mercari had the tool in its development environment, so its credentials were stolen and its source code on GitHub was accessed. [1] [3] [4]

Mercari's rule was not to store personal information or credentials on GitHub, but the source code held some. [1]

• Customers: bank code, branch code, account number, account holder name in kana and transfer amount for sales proceeds paid out between August 5, 2013 and January 20, 2014, 17,085 records. [1]
• Customers: names, addresses, email addresses, phone numbers and inquiry contents from customer service between November 2015 and January 2018, 217 records, and names, ages, genders and email addresses from an event in May 2013, 6 records. [1]
• Business partners: sole proprietor names of Merpay merchants, 7,925 records, and names, birth dates, affiliations and email addresses of business partners, 41 records. [1]
• Employees: names, company email addresses, employee IDs, phone numbers and birth dates, including subsidiaries, former staff and some contractors, 2,615 records. [1]

The total at the May 21 announcement was 27,889. The August 6 results added 13 customer records (names, addresses, birth dates and transaction messages from customer service between December 2015 and February 2019) and 25 employee records, bringing the total to 27,927. No unauthorized access to running services and no misuse of the leaked data were confirmed. [1] [2] [5]