ACRO: the official online shops of "THREE" and "Amplitude" were accessed without authorization, and up to 103,935 pieces of data including card data may have leaked

1. 2021-08-20

   It confirmed a concern that card data might have leaked and cut external access. It stopped card payments the same day at the four official online shops "THREE", "Amplitude", "ITRIM" and "FIVEISM × THREE". [2]

2. 2021-10-22

   The third-party investigation finished and confirmed that card data might have leaked at the two shops "THREE" and "Amplitude". [2]

3. 2022-02-24

   It announced the case. [1] [2]

A vulnerability in part of the system was exploited and the payment application was altered; up to 103,935 pieces of personal data including card data may have leaked. The other Pola Orbis group companies are separate companies using separate e-commerce systems, and the group says they were not affected. [1] [2]