> JapanHacked_
[Resolved][Severity: Critical][Web app exploit]

MACHATT: its online store was accessed without authorization and card data of 16,093 customers may have leaked

The system of its online store was tampered with; card data of 16,093 customers who shopped from August 2021 to February 2022 may have leaked.

Disclosed

2022-05-18

Organizations involved

1

Leaked or at risk

16.1K

16,093

Downtime

Unknown

What happened

  1. A card company warned of possible leakage, and it stopped card payments. [1] [2]

  2. The investigation by a third-party firm finished. [1]

  3. It announced the case. [1] [2]

Impact

Card holder names, numbers, expiry dates and security codes of 16,093 customers who paid by card from August 10, 2021 to February 22, 2022 may have leaked. It reported to the police on April 21 and to the Personal Information Protection Commission on April 27. [1] [2]

Timeline

  1. Started 2021-08-10
  2. Detected 2022-02-22
  3. Disclosed 2022-05-18
  4. 281 days

Attack or cause

Method
[Web app exploit]
Impact
[Data leak]
Entry point
Web app

Data exposed or at risk

[Payment card][Name]

Organizations involved

Open in organization search

Sources

  1. [1][Official]弊社が運営する「MACHATT ONLINE STORE」への不正アクセスによる個人情報漏えいに関するお詫びとお知らせMACHATT Inc. · 2022-05-18
  2. [2][News]女性服ECでクレカ情報1.6万件漏えいの可能性　不正アクセス・システム改ざん被害で - ITmedia NEWSITmedia NEWS · 2022-05-20