GR: servers of its Omni EC system were accessed without authorization, and customer data of ten retailers leaked

1. 2021-09-01

   A retailer made an inquiry about a failure. [1]

2. 2021-09-03

   Traces of a leak were confirmed on two servers. [1]

3. 2021-09-04

   GR and Toshiba Tec, which handles the service, notified the retailers. [1]

4. 2021-09-06

   Ryubo Store switched to another system. [2]

5. 2021-09-16

   GR, Toshiba Tec and retailers including Summit and Maruhisa announced the case one after another. [1] [3]

6. 2021-09-17

   Ryubo Store and others announced the case. [2]

7. 2021-11-01

   Beisia announced the case. Card data of 3,101 and personal data of 254,207 may have leaked. [4] [5]

8. 2021-11-10

   Tsuruha Holdings, the parent of Kyorindo Pharmacy, announced the case. Card data of 322 and customer data of 6,882 may have leaked. [6] [7]

9. 2021-11-15

   Grand Tomato published its investigation result. Card data of 349 may have leaked. [8]

10. 2021-11-26

    Grand Tomato published an additional result. Member and order data of 4,910 may have been viewed. [9]

11. 2021-11-30

    Shibazushi announced the case. [10]

12. 2021-12-06

    Kutsuma Suisan, which runs the Uogashi Sushi chain, announced the case. Card data of 652 may have leaked. [12] [13]

A vulnerability in a dedicated GR server was exploited and a malicious program planted. By retailer: Tenmaya Store 71,480, Summit about 40,000 (no card data), Maruhisa 25,693, Ryubo Store 6,337 (1,201 members and 5,136 reservations), Grand Tomato about 5,000 (about 250 with card data). Maruyoshi Center was also affected. [1] [2] [3]

In November three more retailers announced the case. Beisia said card data of 3,101 and personal data of 254,207 (registered members, guest buyers and in-store pickup reservations) may have leaked. Kyorindo Pharmacy said card data of 322 and data of 6,882 online shop users and in-store reservations were affected. Shibazushi said names, addresses and other data of 16,131 customers and 1,607 card records (1,544 customers) may have leaked. [4] [6] [11]

Grand Tomato's investigation found that card data of 349 may have leaked and that member and order data of 4,910 (names, company names, genders, addresses, phone numbers and email addresses) may also have been viewed. [8] [9]

In December, Kutsuma Suisan, which runs the "Uogashi Sushi takeout reservation site", announced the case. Card data of 652 used between March 26 and August 19, 2021 may have leaked. [12] [13]