[Resolved][Severity: Critical][Web app exploit]

Hinode Publishing: its online shops Safari Lounge and Official Store were accessed without authorization, and data of 5,947 cards in total may have leaked, with about a year from the warning to the report

Vulnerabilities of two online shops were exploited, and data of 4,544 cards at Safari Lounge and 1,403 at the Official Store may have leaked.

Disclosed

2021-06-10

Organizations involved

Leaked or at risk

Unknown

Downtime

Unknown

What happened

2020-01-09
From this day, card data entered on Safari Lounge, the official online shop of the magazine Safari, began to leak through a vulnerability in the system. [1]
2020-04-22
From this day, card data used on the Hinode Publishing Official Store also began to leak. [1]
2020-05-27
A credit card company, through a payment processing company, pointed out that card data might have leaked. [1]
2020-05-29
The period of possible leaks on Safari Lounge ended. [1]
2020-06-04
The period of possible leaks on the Official Store ended. [1]
2020-07-17
The investigation finished. [1]
2020-12-18
It reported to the Personal Information Protection Commission and the police. [1]
2021-06-10
It announced the case and began explaining the matter to the customers concerned by email, apologizing. [1] [2] [3]

Impact

Site	Period	Card data
Safari Lounge	January 9 to May 29, 2020	4,544
Hinode Publishing Official Store	April 22 to June 4, 2020	1,403

[1]

The names, numbers, expiry dates and security codes of the cards may have leaked and may have been misused. Customers were urged to watch for charges they do not recognize. It took about a year from the card company's warning to the report to customers, and about eleven months from the end of the investigation to the announcement. [1] [2] [3]