[Resolved][Severity: Critical][Web app exploit]

JA Takasaki Ham: its online shop Takasaki Ham Online Shopping was accessed without authorization and its payment application was altered, so data of 183 cards of 123 customers may have leaked

The payment application was altered, and data of 183 cards of 123 customers from about a year may have leaked, with some possibly misused.

Disclosed

2021-06-09

Organizations involved

Leaked or at risk

Unknown

Downtime

Unknown

What happened

2020-02-03
From this day, a vulnerability of the site was exploited and the payment application was altered, so card data used on the site leaked outside. [1] [2]
2021-01-06
A credit card company pointed out a possible leak and the problem came to light. Card payments were stopped on this day. [1] [2]
2021-02-26
The investigation by an outside firm finished. [1]
2021-03-22
It reported the damage to the police. [1]
2021-04-28
It reported to the Ministry of Agriculture, Forestry and Fisheries, which has jurisdiction. [1]
2021-06-09
It announced the case and began explaining the matter to the customers concerned by email or letter, apologizing. [1] [2]

Impact

The names, numbers, expiry dates, security codes and the like of 183 credit cards of 123 customers who used the site between February 3, 2020 and January 6, 2021, when payments were stopped, may have leaked, and some may have been misused. Customers were asked to check for charges they do not recognize. [1] [2]