Drome: its e-cigarette online shop Veplog Shop was accessed without authorization and given a fake payment form, so 32 cards may have leaked, and member data of its review site Veplog was also affected

1. 2021-04-11 00:54

   A vulnerability in part of the system of Veplog Shop was exploited, and a fake credit card payment form was placed. [1]

2. 2021-04-12 13:25

   The period when the fake payment form was present ended. On this day, however, an error on the order screen was found, card payments were stopped and a third-party body began investigating. [1] [2]

3. 2021-04-30

   It reported to the Personal Information Protection Commission. [1] [3]

4. 2021-05-17

   The investigation finished. [1] [3]

5. 2021-05-31

   It reported the damage to the police. [1]

6. 2021-06-07

   It announced the case and began notifying the customers concerned by email. It also became clear that member data of the review site Veplog may have leaked. [1] [2] [3]

7. 2021-06-21

   After continued investigation, it issued a follow-up saying that names, contact details, addresses and purchase history of shop members and of buyers who did not register may also have leaked. This did not include credit card data. [1]

• Card holder names, card numbers, expiry dates and security codes of 32 customers who paid by card on Veplog Shop between 0:54 on April 11 and 13:25 on April 12, or who ordered without completing payment. Data of customers who entered card data into the fake form but did not buy may also have leaked, but they could not be identified. [1] [2]
• Names, email addresses, passwords, phone numbers, purchaser addresses, delivery addresses and purchase history of customers who registered as members of Veplog Shop; the same items except passwords for those who bought without registering. Veplog Shop storefronts on Rakuten Ichiba, Amazon, Yahoo! Shopping, au PAY Market and Qoo10 were not affected. [1]
• Email addresses, account names and passwords of people who registered as members of the review site Veplog by April 27, 2021. The number was not disclosed. [3]

The company apologized for the time between the April 12 concern and the announcement. It said it judged that publishing uncertain information would cause confusion and so waited for the investigation firm's results and coordination with the card companies. The reopening date was not set. It asked the card companies to have it bear the card reissue fees. [1]