> JapanHacked_
[Resolved][Severity: Critical][Web app exploit]

Daiichi Denkasha: its cafe goods online shop Daiichi F&L Online Shop was accessed without authorization and its payment application was altered, so up to 2,551 cards of 1,246 customers may have leaked and been misused

The payment application was altered, and up to 2,551 cards from about a year may have leaked and been misused.

Disclosed

2021-06-17

Organizations involved

1

Leaked or at risk

2.6K

2,551

Downtime

Unknown

What happened

  1. From this day, the payment application was altered and newly entered card data began to leak. [1] [2]

  2. The problem came to light after a credit card company pointed it out. Card data up to this day is covered. [1] [2]

  3. The investigation finished. [2]

  4. It reported to the Personal Information Protection Commission and the police. [2]

  5. It began contacting the customers concerned. [1] [2]

Impact

Up to 2,551 cards of 1,246 customers entered between March 3, 2020 and February 12, 2021 may have leaked and been misused. [1] [2]

Timeline

  1. Started 2020-03-03
  2. Detected 2021-02-12
  3. Disclosed 2021-06-17
  4. 471 days

Attack or cause

Method
[Web app exploit]
Impact
[Data leak]
Entry point
Web app

Data exposed or at risk

[Payment card][Name]

Services hit

Organizations involved

Open in organization search

Sources

  1. [1][News]カフェ関連商品を扱う通信販売サイトに不正アクセスSecurity NEXT · 2021-06-18
  2. [2][News]エスプレッソマシン専門ECサイトへ不正アクセス、最大2,551枚のカード情報流出の可能性ScanNetSecurity · 2021-06-21 08:00