Sanrio Entertainment: its corporate site was hit by SQL injection, and 46,421 email addresses of Sanrio Puroland fan club members may have leaked

1. 2021-05-30 19:30

   From around this time, the corporate site was accessed without authorization through an SQL injection vulnerability. [1]

2. 2021-05-31 21:00

   By around this time, the unauthorized access had ended. A check of the site showed an error, and an investigation revealed the damage. [1]

3. 2021-06-05

   It explained the case to the customers concerned by email and apologized. It announced the case. [1] [2]

The data reachable through the SQL injection was only the email addresses of 46,421 members and provisional registrants of the Puroland Fan Club, and the company denied that names, addresses, birth dates or credit card data leaked. It said it never asks for personal information by email, phone or letter, and urged caution. It took measures against the unauthorized access, and although no unauthorized access to the Sanrio Puroland website was confirmed, it re-verified that site's safety and strengthened its web development and management structure. [1]