> JapanHacked_
[Resolved][Severity: Major][Web app exploit]

Beads: its website was accessed without authorization and 23,435 customer and partner email addresses may have leaked

An SQL injection flaw was exploited, and 10,772 customer and 12,663 partner email addresses may have leaked.

Disclosed

2022-02-28

Organizations involved

1

Leaked or at risk

23.4K

23,435

Downtime

Unknown

What happened

  1. It noticed external unauthorized access exploiting an SQL injection flaw. [1]

  2. It began notifying affected customers and partners by email. It notified the Personal Information Protection Commission and filed a damage report with the police. [1]

Impact

The addresses that may have leaked are 10,772 customer addresses (some survey respondents and customers of the parts sales system from June 2013 to April 2016) and 12,663 partner addresses. [1]

Timeline

  1. Detected 2022-02-21
  2. Disclosed 2022-02-28
  3. 7 days

Attack or cause

Method
[Web app exploit]
Impact
[Data leak]
Entry point
Web app

Data exposed or at risk

[E-mail address]

Organizations involved

Open in organization search

Sources

  1. [1][News]SQLi攻撃でメールアドレスが流出か - アウトドア用品企画会社Security NEXT · 2022-03-03
  2. [2][News]ブランド製品企画開発のビーズにSQLインジェクション、23,000件のメールアドレス流出ScanNetSecurity · 2022-03-02 08:05