> JapanHacked_
[Resolved][Severity: Major][Misconfiguration]

Heiwado: a bug on its gift and osechi shop let customers see others' data, involving up to 4,774 records

A program bug let other buyers see purchasers' data on its mail-order site.

Disclosed

2021-11-30

Organizations involved

1

Leaked or at risk

4.8K

4,774

Downtime

Unknown

What happened

  1. A customer who had ordered a gift reported being able to see other customers' order histories. [1]

  2. It announced the case. [1]

Impact

A program bug let buyers who ordered without registering see the data of other non-registered buyers. Up to 4,774 records were involved, and it was not an attack. [1]

Timeline

  1. Detected 2021-11-24
  2. Disclosed 2021-11-30
  3. 6 days

Attack or cause

Method
[Misconfiguration]
Impact
[Data leak]
Entry point
Web app

Data exposed or at risk

[Purchase history]

Organizations involved

Open in organization search

Sources

  1. [1][News]滋賀県のスーパー平和堂のショップサイトで最大4,774件の個人情報が閲覧可能にScanNetSecurity · 2021-12-03 08:05