> JapanHacked_
[Resolved][Severity: Critical][Web app exploit]

Harmonick: its catalog gift online shop was accessed without authorization, card data of up to 28,700 customers and personal data of up to 150,236 may have leaked, and the announcement came about five months after it noticed

The shop's application was tampered with, and card data of up to 28,700 customers and personal data of up to 150,236 may have leaked.

Disclosed

2022-07-13

Organizations involved

1

Leaked or at risk

150.2K

150,236

Downtime

Unknown

What happened

  1. It noticed a concern that card data had leaked. [1]

  2. It announced the case, about five months after it noticed. [1]

Impact

A vulnerability in the site was exploited and its application was tampered with. Card data of up to 28,700 customers who paid from November 14, 2020 to November 11, 2021, and personal data of up to 150,236 people up to November 14, 2020, may have leaked. The company's own notice could not be found. [1]

Timeline

  1. Started 2020-11-14
  2. Detected 2022-02-08
  3. Disclosed 2022-07-13
  4. 606 days

Attack or cause

Method
[Web app exploit]
Impact
[Data leak]
Entry point
Web app

Data exposed or at risk

[Payment card][Name]

Organizations involved

Open in organization search

Sources

  1. [1][News]カタログギフトECのハーモニックがクレカ情報漏洩、発覚から半年後の公表 | 日経クロステック（xTECH）Nikkei xTECH · 2022-07-14