> JapanHacked_
[Resolved][Severity: Critical][Web app exploit]

Icons: its ALPHAICON official shop was accessed without authorization, and card data of 93 customers may have leaked

The payment application was altered, and card data of 93 customers who paid by card over a week in July may have leaked.

Disclosed

2021-10-20

Organizations involved

1

Leaked or at risk

93

93

Downtime

Unknown

What happened

  1. From this day, card data began to leak. [1] [2]

  2. The maintenance company reported a concern about card data leaking, and card payments were stopped the same day. The period of the card data leak ended on this day. [1] [2]

  3. The investigation by a third-party firm finished. [1] [2]

  4. It reported to the Personal Information Protection Commission and filed a damage report with the police. [1]

  5. It announced the case. [1] [2]

Impact

The card holder names, numbers, expiry dates and security codes of 93 customers who paid by card between July 6 and July 12, 2021 may have leaked. A vulnerability was exploited and the payment application altered. [1] [2]

Timeline

  1. Started 2021-07-06
  2. Detected 2021-07-12
  3. Disclosed 2021-10-20
  4. 106 days

Attack or cause

Method
[Web app exploit]
Impact
[Data leak]
Entry point
Web app

Data exposed or at risk

[Payment card][Name]

Organizations involved

Open in organization search

Sources

  1. [1][News]ドッグウェアの通販サイトに不正アクセス - クレカ情報流出Security NEXT · 2021-10-20
  2. [2][News]ペット用品取扱い「アルファアイコンオフィシャルショップサイト」に不正アクセス、1週間で発覚ScanNetSecurity · 2021-10-22 08:05