> JapanHacked_
[Resolved][Severity: Major][Web app exploit]

Ishibashi Music: unauthorized access to its web server may have leaked 98,635 point card members' email addresses

An SQL injection attack reached a database table, and 98,635 members' email addresses may have leaked.

Disclosed

2022-01-11

Organizations involved

1

Leaked or at risk

98.6K

98,635

Downtime

Unknown

What happened

  1. Traces showed that an SQL injection attack on a vulnerability in a web server program had reached a database table. [1] [2]

  2. It announced the case. It reported to the Personal Information Protection Commission and the police. [1] [2]

Impact

Email addresses of 98,635 customers who registered as point card members between September 5, 2006 and November 27, 2020 may have leaked. Names, addresses and credit card data did not leak. It notified the affected customers by email individually, stopped the attacked program and took countermeasures. [1]

Timeline

  1. Started, Detected 2021-12-20
  2. Disclosed 2022-01-11
  3. 22 days

Attack or cause

Method
[Web app exploit]
Impact
[Data leak]
Entry point
Web app

Data exposed or at risk

[E-mail address]

Organizations involved

Open in organization search

Sources

  1. [1][News]サーバにSQLi攻撃、会員メアドが流出か - イシバシ楽器Security NEXT · 2022-01-13
  2. [2][News]イシバシ楽器WebサーバにSQLインジェクション攻撃、約10万件の会員メールアドレスが流出ScanNetSecurity · 2022-01-13 08:05