> JapanHacked_
[Resolved][Severity: Critical][Web app exploit]

Daito: "DIY FACTORY Business" was accessed without authorization and users were led to a fake card entry page, leaking card data

The payment application was tampered with and users were led to a fake card entry page. The card company raised the concern on April 20 and the site was closed.

Disclosed

2022-08-01

Organizations involved

1

Leaked or at risk

Unknown

Downtime

Unknown

What happened

  1. The card company raised a concern about a leak, and the site was closed the same day. [1] [2]

  2. The investigation finished. [1] [2]

  3. It announced the case. The payment application had been tampered with and users were led to a fake card entry page. [1] [2]

Timeline

  1. Detected 2022-04-20
  2. Disclosed 2022-08-01
  3. 103 days

Attack or cause

Method
[Web app exploit]
Impact
[Data leak]
Entry point
Web app

Data exposed or at risk

[Payment card][Name]

Organizations involved

Open in organization search

Sources

  1. [1][Official]株式会社大都「DIY FACTORY Business」における不正アクセスによるお客様情報流出について｜楽天カードRakuten Card Co., Ltd. · 2022-08-01
  2. [2][News]「DIY FACTORY Business」に不正アクセス、偽のクレジットカード情報入力ページに意図的に誘導ScanNetSecurity · 2022-08-04 08:05