> JapanHacked_
[Resolved][Severity: Critical][Web app exploit]

Umano Chemical Container: its former online shop was accessed without authorization, and card data of 191 customers may have leaked

The payment application was altered, and card data of 191 customers may have leaked. The site had stopped card payments in February 2021.

Disclosed

2022-01-12

Organizations involved

1

Leaked or at risk

191

191

Downtime

Unknown

What happened

  1. It had stopped card payments at its former online shop when switching its cart system. [1]

  2. Some card companies told it of concerns about leaked card data, and it began an investigation by a third-party firm. [1]

  3. The investigation finished and confirmed that card data had leaked and some might have been misused. [1]

  4. Rakuten Card urged its members to be careful after the company's announcement. [2]

Impact

A vulnerability in part of the system was exploited and the payment application was altered; card data of 191 customers may have leaked. [1]

Timeline

  1. Detected 2021-02-25
  2. Disclosed 2022-01-12
  3. 321 days

Attack or cause

Method
[Web app exploit]
Impact
[Data leak]
Entry point
Web app

Data exposed or at risk

[Payment card]

Organizations involved

Open in organization search

Sources

  1. [1][News]旧「馬野化学容器株式会社ネットショップ」に不正アクセス、191名分のカード情報が流出ScanNetSecurity · 2022-01-14 08:05
  2. [2][News]馬野化学容器株式会社「馬野化学容器株式会社ネットショップ」における不正アクセスによるお客様情報流出についてRakuten Card · 2022-01-12