[Resolved][Severity: Critical][Web app exploit]

Right-on: its official online shop was accessed without authorization, and names, addresses and more of 247,600 members leaked

A vulnerability in the online shop system was exploited and data on 247,600 members leaked. Card data was not included.

Disclosed

2021-11-04

Organizations involved

Leaked or at risk

247.6K

247,600

Downtime

Unknown

What happened

2021-10-23
From this day, there was intermittent unauthorized access by a third party. [1]
2021-10-27
It detected an abnormal number of accesses. [1]
2021-10-28
The unauthorized access came to light, and emergency security measures were taken. [1] [3]
2021-10-29
Unauthorized access occurred again. It strengthened the measures further and blocked communication from the source. [1]
2021-10-30
It found that the leaked information included customers' personal data. [1] [3]
2021-11-03
It notified the police and reported to the Personal Information Protection Commission. [1]
2021-11-04
It announced the case and contacted each customer confirmed to be affected. It also set up an inquiry desk. [1] [2]

Impact

Names, phone numbers, addresses, birth dates, genders and email addresses of 247,600 Right-on Members leaked. Credit card data and passwords for the official online shop were not included, and no secondary damage was confirmed. The cause was unauthorized access exploiting a vulnerability in the online shop system. [1] [2]