> JapanHacked_
[Resolved][Severity: Critical][Web app exploit]

Kamei Proact: the old "PATRICK Online Shop" was accessed without authorization and card data of 5,172 customers may have leaked, with no effect on the new site

On the site it replaced in February 2022, card data of 5,172 customers over about nine months may have leaked. The new site was not affected.

Disclosed

2022-07-07

Organizations involved

1

Leaked or at risk

5.2K

5,172

Downtime

Unknown

What happened

  1. Some card companies told the company of a concern that card data of customers who used the site it replaced on February 1, 2022 had leaked. [1]

  2. It started an investigation by a third-party firm. [1]

  3. The investigation finished and found that the site had been accessed without authorization before April 30, 2021. [1]

  4. It announced the case and began contacting the customers concerned individually. [1] [2]

Impact

A vulnerability in the system was exploited and a malicious file was placed. The card holder names, numbers, expiry dates, security codes, email addresses and IP addresses of 5,172 customers in total who paid by card from April 30, 2021 to January 30, 2022 may have leaked. Some cards may have been misused. The site concerned has been closed. [1]

Timeline

  1. Started 2021-04-30
  2. Detected 2022-03-16
  3. Disclosed 2022-07-07
  4. 433 days

Attack or cause

Method
[Web app exploit]
Impact
[Data leak]
Entry point
Web app

Data exposed or at risk

[Payment card][Name][E-mail address]

Organizations involved

Open in organization search

Sources

  1. [1][Official]「（旧）PATRICK（パトリック）オンラインショップ」への 不正アクセスによる個人情報漏えいに関するお詫びとお知らせ – PATRICK｜パトリック公式オンラインショップKamei Proact Corporation
  2. [2][News]カメイ・プロアクト株式会社「（旧）PATRICK（パトリック）オンラインショップ」におけるカード情報流出について｜お知らせ｜イオン銀行AEON Bank · 2022-07-07