> JapanHacked_
[Resolved][Severity: Critical][Web app exploit]

Tachikichi: its online shop was accessed without authorization, and card data of 677 customers may have leaked

The payment application was altered, and card data of 677 customers may have leaked. Announcement came 95 days after discovery.

Disclosed

2021-09-07

Organizations involved

1

Leaked or at risk

677

677

Downtime

Unknown

What happened

  1. From this day, card data began to leak. [1]

  2. The period of the card data leak ended on this day. [1]

  3. A possible leak came to light, and the site was stopped the same day. [1]

  4. The investigation finished. [1]

  5. It reported to the Personal Information Protection Commission and the police. [1]

  6. It announced the case. [1]

Impact

Card data of 677 customers who paid by card between March 31 and April 26, 2021 may have leaked. The payment application had been altered. [1]

Timeline

  1. Started 2021-03-31
  2. Detected 2021-06-04
  3. Disclosed 2021-09-07
  4. 160 days

Attack or cause

Method
[Web app exploit]
Impact
[Data leak]
Entry point
Web app

Data exposed or at risk

[Payment card][Name]

Organizations involved

Open in organization search

Sources

  1. [1][News]和洋陶磁器取扱い「たち吉オンラインショップ」に不正アクセス、677名のカード情報流出ScanNetSecurity · 2021-09-10 08:05