[Resolved][Severity: Critical][Web app exploit]

Fuji Dry: the payment application of its kimono cleaning delivery site Sentaku Kobo was tampered with, and credit card data of 565 people may have leaked and been misused

The payment application was tampered with and card data of 565 people from about a year may have leaked. It took about eight months from a card company's alert to the announcement.

Disclosed

2021-05-17

Organizations involved

Leaked or at risk

565

Downtime

Unknown

What happened

2019-09-12
From this day, card data may have begun to be stolen through the tampered payment application. [1] [2]
2020-09-17
Card data of customers who ordered cleaning up to this day was affected. [1] [2]
2020-09-18
A credit card company pointed out a concern about a leak, and the problem came to light. The company stopped card payments that day and had a third-party body investigate. [1] [2]
2020-12-21
The investigation was completed. [1] [2]
2020-12-29
It reported to the police. [1] [2]
2021-04-19
It reported to the Ministry of Economy, Trade and Industry and the Personal Information Protection Commission. [1] [2]
2021-05-17
It announced the case and contacted the customers concerned by email. [1] [2]

Impact

The card names, numbers, expiry dates and security codes of 565 customers who ordered cleaning on Sentaku Kobo between September 12, 2019 and September 17, 2020 may have leaked, and some may have been misused. The company asked customers to check for charges they do not recognize. [1] [2]