> JapanHacked_
[Resolved][Severity: Critical][Web app exploit]

Irodori: the "mogans WEB shop" was accessed without authorization and card data of 977 customers may have leaked

The payment application was altered, and card data of 977 customers may have leaked. Some may have been misused.

Disclosed

2022-03-23

Organizations involved

1

Leaked or at risk

977

977

Downtime

Unknown

What happened

  1. Some card companies told it of concerns about leaked card data. It stopped card payments the same day and began an investigation by a third-party firm. [1]

  2. The investigation finished and confirmed that card data had leaked and some might have been misused. [1]

  3. It announced the case. Rakuten Card urged its members to be careful. [1] [2]

Impact

A vulnerability in part of the system was exploited and the payment application was altered; card data of 977 customers may have leaked. [1]

Timeline

  1. Detected 2022-01-28
  2. Disclosed 2022-03-23
  3. 54 days

Attack or cause

Method
[Web app exploit]
Impact
[Data leak]
Entry point
Web app

Data exposed or at risk

[Payment card][Name]

Organizations involved

Open in organization search

Sources

  1. [1][News]化粧品販売「mogans WEBショップ」に不正アクセス、977名分のカード情報が流出ScanNetSecurity · 2022-03-25 08:00
  2. [2][News]彩り株式会社「mogansWEBショップ」における不正アクセスによるお客様情報流出についてRakuten Card · 2022-03-23