> JapanHacked_
[Resolved][Severity: Critical][Web app exploit]

Soke Genkichoan: its online shop was accessed without authorization and card data of 14,127 customers may have leaked

Its online shop was accessed without authorization; card data of 14,127 customers who shopped from February 2021 to January 2022 may have leaked.

Disclosed

2022-05-24

Organizations involved

1

Leaked or at risk

14.1K

14,127

Downtime

Unknown

What happened

  1. A card company warned of possible leakage, and it stopped card payments the same day. [1]

  2. A third-party firm began an investigation. [1]

  3. The investigation finished. [1]

  4. It announced the case. [1]

Impact

Card holder names, numbers, expiry dates and security codes of 14,127 customers who paid by card from February 4, 2021 to January 31, 2022 may have leaked. It reported to the Personal Information Protection Commission on March 29 and to the police on April 6. It has run on a new system since February 1, 2022. [1]

Timeline

  1. Started 2021-02-04
  2. Detected 2022-03-07
  3. Disclosed 2022-05-24
  4. 474 days

Attack or cause

Method
[Web app exploit]
Impact
[Data leak]
Entry point
Web app

Data exposed or at risk

[Payment card][Name]

Organizations involved

Open in organization search

Sources

  1. [1][News]「宗家源吉兆庵」のECサイトに不正アクセス、カード情報1万4000件が漏洩の可能性 | 日経クロステック（xTECH）Nikkei xTECH · 2022-05-24