> JapanHacked_
[Resolved][Severity: Critical][Web app exploit]

Caucus (now Shuri Sekken): its SuiSavon online shop was accessed without authorization, and card and personal data of up to 1,217 customers leaked

The payment application was altered, and personal and card data of up to 1,217 customers leaked.

Disclosed

2021-12-20

Organizations involved

1

Leaked or at risk

1.2K

1,217

Downtime

Unknown

What happened

  1. A payment agent pointed out a concern about leaks of customers' personal and card data. It stopped card payments. [1]

  2. It asked a third-party firm for a forensic investigation. [1]

  3. The investigation finished. [1]

  4. It announced the case. [1]

Impact

Unauthorized access by a third party to the system altered the payment application, and personal and card data of up to 1,217 customers leaked. The company was then named Caucus and changed its name to Shuri Sekken in October 2024. [1]

Timeline

  1. Detected 2021-04-21
  2. Disclosed 2021-12-20
  3. 243 days

Attack or cause

Method
[Web app exploit]
Impact
[Data leak]
Entry point
Web app

Data exposed or at risk

[Payment card][Name]

Organizations involved

Open in organization search

Sources

  1. [1][News]「SuiSavon-首里石鹸-オンラインショップ」に不正アクセス、最大1,217名のカード情報流出ScanNetSecurity · 2021-12-23 08:05