> JapanHacked_
[Resolved][Severity: Critical][Web app exploit]

Candil Design: its repair materials online shop Pro Shop Takumi was accessed without authorization, and card data of 3,357 customers may have leaked

Card data of 3,357 customers from about two and a half years may have leaked through unauthorized access.

Disclosed

2021-07-20

Organizations involved

1

Leaked or at risk

3.4K

3,357

Downtime

Unknown

What happened

  1. From this day, the site was accessed without authorization and card data began to leak. [1]

  2. A credit card company told the company of a concern about a leak. Card data up to this day is covered. [1]

  3. The investigation finished. [1]

  4. It reported to the police. [1]

  5. It reported to the Personal Information Protection Commission. [1]

  6. It announced the case as a subsidiary of Candil, a company listed on the first section of the Tokyo Stock Exchange. [1]

Impact

The names, numbers, expiry dates and security codes of 3,357 customers who paid by card between July 3, 2018 and January 26, 2021 may have leaked. [1]

Timeline

  1. Started 2018-07-03
  2. Detected 2021-01-26
  3. Disclosed 2021-07-20
  4. 1113 days

Attack or cause

Method
[Web app exploit]
Impact
[Data leak]
Entry point
Web app

Data exposed or at risk

[Payment card][Name]

Organizations involved

Open in organization search

Sources

  1. [1][News]補修材専門店「ECサイトプロショップ匠」に不正アクセス、約2年半分の決済情報流出ScanNetSecurity · 2021-07-21 08:00