[Resolved][Severity: Moderate][Web app exploit]

Royal Home Center: the server of its official site was accessed without authorization and the site was stopped for about three weeks. No leak of personal data was found

A vulnerability in the system was exploited to break into the server of its official site. The investigation found no sign of a leak of personal data.

Disclosed

2021-12-01

Organizations involved

Leaked or at risk

Unknown

Downtime

Unknown

What happened

2021-11-12
The contractor that manages the site reported suspected unauthorized access to the server. The same day it stopped the site, cut outside access and began an investigation. [1] [2]
2021-11-29
The investigation firm reported that no fact or suspected trace of a data leak was found. [1]
2021-12-01
It replaced the server, reopened the site and announced the case. Some functions had not resumed. [1] [2]

Cause and impact

A weak part of the system was exploited to break into the server. There is no trace of data including personal data flowing out, and it judges the possibility of a leak to be extremely low. The official app (smartphone membership card) and the online store "Roi Mall" use other systems and were not affected. [1]