[Resolved][Severity: Critical][Web app exploit]

Tocochan.com: its EC site was accessed without authorization, and 507 card records and login data may have leaked

The payment application was altered, and 507 card records from about two weeks of payments, plus login IDs and passwords, may have leaked.

Disclosed

2021-11-15

Organizations involved

Leaked or at risk

507

Downtime

Unknown

What happened

2021-06-17
From this day, the period in which card data and more may have leaked began. [1]
2021-07-02
The period in which data may have leaked ended on this day. [1]
2021-07-06
It found a file it did not manage and a suspicious order containing cross-site scripting code. The same day it stopped the site and began an investigation by a third-party firm. [1] [2]
2021-09-28
The investigation finished. [1] [2]
2021-10-06
It reported to the police. [1]
2021-10-07
It reported to the Personal Information Protection Commission. [1]
2021-11-15
It announced the case and notified the customers concerned by letter. [1] [2]

Impact

The card holder names, numbers, expiry dates and security codes of 507 card payments made between June 17 and July 2, 2021, and login IDs and passwords, may have leaked. A vulnerability in part of the site system was exploited and the payment application altered. [1]