> JapanHacked_
[Resolved][Severity: Critical][Web app exploit]

Tanax: its online shop was accessed without authorization, and card data of 26 customers may have leaked, including 3-D Secure passwords

The payment application was altered, and card data of 26 customers may have leaked. Announcement came 293 days after discovery.

Disclosed

2021-10-27

Organizations involved

1

Leaked or at risk

26

26

Downtime

Unknown

What happened

  1. From this day, card data began to leak. [1] [2]

  2. A customer reported a concern about card data leaking. The period of the card data leak ended on this day. [1] [2]

  3. Card payments on the site were stopped and a damage report was filed with the police. [1] [2]

  4. The investigation by a third-party firm finished. [1] [2]

  5. It reported to the Personal Information Protection Commission. [1]

  6. It announced the case. [1] [2]

Impact

Card data of 26 customers who paid by card between December 7, 2020 and January 7, 2021 may have leaked. The payment application had been altered. 3-D Secure passwords were also included. [1] [2]

Timeline

  1. Started 2020-12-07
  2. Detected 2021-01-07
  3. Disclosed 2021-10-27
  4. 324 days

Organizations involved

Open in organization search

Sources

  1. [1][News]バイク関連製品通販サイトで個人情報流出のおそれ - 3DセキュアもSecurity NEXT · 2021-10-28
  2. [2][News]バイク用品取扱「TANAXオンラインショップ」に不正アクセス、3Dセキュアパスワード含むカード情報流出ScanNetSecurity · 2021-10-29 08:05