> JapanHacked_
[Resolved][Severity: Critical][Web app exploit]

Access: the "Access Online Shop" was accessed without authorization and card data of 3,360 customers may have leaked

The payment application was altered, and card data of 3,360 customers may have leaked. The investigation took a year to finish.

Disclosed

2022-03-23

Organizations involved

1

Leaked or at risk

3.4K

3,360

Downtime

Unknown

What happened

  1. Some card companies told it of concerns about leaked card data. It stopped card payments the same day and began an investigation by a third-party firm. [1]

  2. The investigation finished and confirmed that card data had leaked and some might have been misused. [1]

  3. It announced the case. [1]

Impact

A vulnerability in part of the system was exploited and the payment application was altered; card data of 3,360 customers may have leaked. [1]

Timeline

  1. Detected 2020-12-17
  2. Disclosed 2022-03-23
  3. 461 days

Attack or cause

Method
[Web app exploit]
Impact
[Data leak]
Entry point
Web app

Data exposed or at risk

[Payment card][Name][Passwords]

Organizations involved

Open in organization search

Sources

  1. [1][News]「アクセス オンラインショップ」への不正アクセスで3,360名のカード情報流出、調査に1年要すScanNetSecurity · 2022-03-29 08:05