> JapanHacked_
[Resolved][Severity: Major][Intrusion]

Borderless: the old site of its doll shop DOLK STATION was accessed without authorization, and information of 24,228 members may have leaked, found after an extortion email

The old site was accessed in March 2019, and addresses, names and passwords of 24,228 members may have leaked. An email demanding money exposed it.

Disclosed

2021-08-20

Organizations involved

1

Leaked or at risk

Unknown

Downtime

Unknown

What happened

  1. From this day until March 31, the old site, from before the renewal on March 16, 2021, was accessed without authorization. [1]

  2. The site was renewed and the old site's service ended. [1]

  3. Customer support received an English threat email saying the sender held personal data and demanding money, and the leak came to light. [1] [2]

  4. It reported to the police and the Personal Information Protection Commission and announced the case. [1] [2]

Information that may have leaked

Of the old site's member data registered by March 31, 2019, 24,228 records of addresses, names, phone numbers, email addresses, birth dates (some), genders, member IDs and passwords. The company holds no credit card data, so none leaked. [1]

Timeline

  1. Started 2019-03-13
  2. Detected 2021-08-19
  3. Disclosed 2021-08-20
  4. 891 days

Attack or cause

Method
[Intrusion]
Impact
[Data leak][Extortion]
Entry point
Unknown

Data exposed or at risk

[Name][Postal address][Phone number][E-mail address][Date of birth][Gender][Passwords]

Organizations involved

Open in organization search

Sources

  1. [1][Official]旧DOLK STATIONオンラインへの不正アクセスに関するお詫びとお願いDOLK Customer Support · 2021-08-20
  2. [2][News]ドール用品専門サイトへの不正アクセスで会員情報流出、金銭要求メール確認ScanNetSecurity · 2021-08-23 08:00