SONS-MARKET: its woodworking tool online shop KQLFT TOOLS was accessed without authorization and its payment function was altered, so card data of 584 customers may have leaked and been misused
The payment function was altered, and card data of 584 customers from about a year may have leaked and been misused.
Disclosed
2021-07-26
Organizations involved
1
Leaked or at risk
584
584
Downtime
Unknown
What happened
From this day, a vulnerability in the site's system was exploited and the card payment function was altered, so card data began to leak. Traces were also tampered with, so the cause is an estimate. [1] [2]
Some credit card companies told the company of a concern about a leak, and it stopped card payments the same day and started an investigation by a third-party firm. [1] [2]
It reported to the Personal Information Protection Commission. [1] [2]
It announced the case and began contacting the customers concerned individually by email. [1] [2]
Impact
Why the announcement was late
The company said it waited for the investigation result and coordination with the card companies after talking with its payment agent, because releasing uncertain information would cause confusion. [1]
Timeline
- Started 2019-11-29
- Detected 2020-11-06
- Disclosed 2021-07-26
- 605 days
Attack or cause
- Method
- [Web app exploit]
- Impact
- [Data leak]
- Entry point
- Web app
Data exposed or at risk
Organizations involved
[Breached][Critical]Chiba, KashiwaWholesale and retail trade584 leaked
SONS-MARKET Co., Ltd.
Sources
- [1][Official]弊社が運営する「KQLFT TOOLS」への不正アクセスによる個人情報漏えいに関するお詫びとお知らせSONS-MARKET Co., Ltd. · 2021-07-26
- [2][News]木工用工具専門店「KQLFT TOOLS」利用者のカード情報流出、不正アクセスの痕跡も改ざんScanNetSecurity · 2021-07-28 08:00