> JapanHacked_
[Resolved][Severity: Critical][Web app exploit]

Net Tower: its Tapioca World shop was accessed without authorization, and 301 cards of 226 customers may have leaked

The payment application was altered, and 301 cards of 226 customers who paid over about 13 months may have leaked.

Disclosed

2021-10-25

Organizations involved

1

Leaked or at risk

301

301

Downtime

Unknown

What happened

  1. From this day, card data began to leak. [1]

  2. The period of the card data leak ended on this day. The same day, the site that had been accessed was closed. [1]

  3. It reopened on a new site built on a new server. [1]

  4. A card company pointed out a possible leak of card data. Card payments were stopped. [1] [2]

  5. The investigation by an outside firm finished. [1] [2]

  6. It reported to the Personal Information Protection Commission. [1]

  7. It filed a damage report with the police. [1]

  8. It announced the case and notified the customers concerned by email. [1] [2]

Impact

Data on 301 cards used by 226 customers who shopped between February 14, 2020 and March 29, 2021 may have leaked. The payment application had been altered to steal the card holder name, number, expiry date and security code. [1]

Timeline

  1. Started 2020-02-14
  2. Detected 2021-04-09
  3. Disclosed 2021-10-25
  4. 619 days

Attack or cause

Method
[Web app exploit]
Impact
[Data leak]
Entry point
Web app

Data exposed or at risk

[Payment card][Name]

Organizations involved

Open in organization search

Sources

  1. [1][News]タピオカ通販サイト、流出クレカ情報が不正利用された可能性Security NEXT · 2021-10-25
  2. [2][News]「タピオカワールド」に不正アクセス、1年分の決済情報流出ScanNetSecurity · 2021-10-27 08:05