[Resolved][Severity: Critical][Web app exploit]

Vector Park: its branded used-clothing online shop was accessed without authorization and card data of 18,136 customers may have leaked, found through a police notice

Card data and login IDs of 18,136 customers who paid from April 2020 to December 2021 may have leaked.

Disclosed

2022-08-18

Organizations involved

Leaked or at risk

18.1K

18,136

Downtime

Unknown

What happened

2021-12-07
The Okayama prefectural police told the company of a possible leak of card data. [1] [2]
2021-12-08
It reported to the police. [1]
2021-12-14
It emailed some customers about the concern that card data had leaked. [1]
2021-12-29
It stopped card payments. [1]
2022-06-28
The investigation by an outside firm finished. [1]
2022-07-11
It reported to the Personal Information Protection Commission. [1]
2022-08-18
It announced the case. [1] [2]

Impact

The card holder names, numbers, expiry dates and security codes, and the login IDs and passwords, of 18,136 customers who paid by card from April 27, 2020 to December 22, 2021 may have leaked. [1] [2]