Cosmos Pharmaceutical: its Cosmos Online Store was accessed without authorization, and card data of 25,484 customers may have leaked
A malicious file was planted, and card data of 25,484 customers from about 14 months may have leaked.
Disclosed
2021-07-12
Organizations involved
1
Leaked or at risk
25.5K
25,484
Downtime
Unknown
What happened
From this day, the site was accessed without authorization and card data began to leak. [1]
Card data up to this day is covered. The site was rebuilt the next day, April 23. [1]
A credit card company told the company of a concern about a leak, and the site was stopped the same day. [1]
The investigation finished and found that a malicious file had been planted. [1]
It reported the damage to the Hakata police station in Fukuoka. [1]
It reported to the Personal Information Protection Commission. [1]
It announced the case. [1]
Impact
The names, numbers, expiry dates and security codes of 25,484 customers who paid by card between February 7, 2020 and April 22, 2021 may have leaked. [1]
Timeline
- Started 2020-02-07
- Detected 2021-05-12
- Disclosed 2021-07-12
- 521 days
Attack or cause
- Method
- [Web app exploit]
- Impact
- [Data leak]
- Entry point
- Web app
Data exposed or at risk
Organizations involved
[Breached][Critical]Fukuoka, Fukuoka, HakataWholesale and retail trade25,484 leaked
Cosmos Pharmaceutical Corporation
Sources
- [1][News]「コスモスオンラインストア」に不正アクセス、25,484件のカード情報が流出ScanNetSecurity · 2021-07-14 08:00