> JapanHacked_
[Resolved][Severity: Critical][Web app exploit]

Reimei: its online shop R Mall, which sells skin care salt and other goods, was accessed without authorization, and credit card data of 2,032 people may have leaked and been misused

A vulnerability was exploited, and card data of 2,032 people from about a year may have leaked, with some possibly misused.

Disclosed

2021-05-27

Organizations involved

1

Leaked or at risk

2K

2,032

Downtime

Unknown

What happened

  1. From this day, card data used at purchase may have begun to be stolen. [1] [2]

  2. A credit card company pointed out a concern about leaked card data. The shop stopped card payments that day and had a third-party body investigate. Card data used up to this day was affected. [1] [2]

  3. The investigation was completed. [1] [2]

  4. It reported to the Personal Information Protection Commission and reported the damage to the police. [1] [2]

  5. It announced the case and began reporting what happened to the customers concerned by letter and apologizing. [1] [2]

Impact

The card names, numbers, expiry dates, security codes and the like of 2,032 people used at purchase between November 5, 2019 and October 20, 2020 may have leaked, and some may have been misused. The company is monitoring transactions on the cards that may have leaked together with the card companies, and asked customers to check for charges they do not recognize. [1] [2]

Timeline

  1. Started 2019-11-05
  2. Detected 2020-10-20
  3. Disclosed 2021-05-27
  4. 569 days

Attack or cause

Method
[Web app exploit]
Impact
[Data leak]
Entry point
Web app

Data exposed or at risk

[Payment card][Name]

Services hit

Organizations involved

Open in organization search

Sources

  1. [1][News]スキンケア用ソルトのオンラインショップに不正アクセスSecurity NEXT · 2021-05-28
  2. [2][News]美容・健康用品取扱いECサイトに不正アクセス、約1年分の決済情報が流出ScanNetSecurity · 2021-05-31 08:00