> JapanHacked_
[Resolved][Severity: Critical][Web app exploit]

Endless: its "PARTS CLUB Online" shop was accessed without authorization, and card data of some customers may have leaked

The payment application was altered after unauthorized access to the internal network, and card data of customers leaked.

Disclosed

2021-11-01

Organizations involved

1

Leaked or at risk

Unknown

Downtime

Unknown

What happened

  1. A customer reported a concern about a leak of personal data. [1]

  2. It stopped card payments and began an investigation by a third-party firm. [1]

  3. The investigation by the firm finished. [1]

  4. It announced the case. [1]

  5. It announced that it would reopen on November 15 and switch card payment to link-type payment, where customers enter card data on the payment provider's screen. [2]

Cause and impact

The payment application of "PARTS CLUB Online" was altered through unauthorized access to the internal network. Card data of customers leaked, and some of it may have been misused. [1]

Timeline

  1. Detected 2021-06-30
  2. Disclosed 2021-11-01
  3. 124 days

Attack or cause

Method
[Web app exploit]
Impact
[Data leak]
Entry point
Web app

Data exposed or at risk

[Payment card][Name]

Organizations involved

Open in organization search

Sources

  1. [1][News]アクセサリーパーツ販売ECサイトでカード情報流出、社内ネットワークへの不正アクセス経由しペイメントアプリケーション改ざんScanNetSecurity · 2021-11-04 08:05
  2. [2][Official]PARTS CLUBのECサイト「パーツクラブ・オンライン」11/15(月)より再開・プレオープンのご案内 | 株式会社エンドレスのプレスリリースEndless Co., Ltd. · 2021-11-12