> JapanHacked_
[Resolved][Severity: Critical][Web app exploit]

Anzu: "Anzu no Helmet" was accessed without authorization and card data of 436 customers may have leaked

The payment application was altered, and card data of 436 customers may have leaked. Some may have been misused.

Disclosed

2022-03-28

Organizations involved

1

Leaked or at risk

436

436

Downtime

Unknown

What happened

  1. Some card companies told it of concerns about leaked card data. It stopped card payments the same day and began an investigation by a third-party firm. [1]

  2. The investigation finished and confirmed that card data had leaked and some might have been misused. [1]

  3. It announced the case. [1]

Impact

A vulnerability in part of the system was exploited and the payment application was altered; card data of 436 customers may have leaked. [1]

Timeline

  1. Detected 2021-11-01
  2. Disclosed 2022-03-28
  3. 147 days

Attack or cause

Method
[Web app exploit]
Impact
[Data leak]
Entry point
Web app

Data exposed or at risk

[Payment card][Name]

Organizations involved

Open in organization search

Sources

  1. [1][News]「あんずのヘルメット」に不正アクセス、436名分のカード情報が流出ScanNetSecurity · 2022-03-31 08:05