> JapanHacked_
[Resolved][Severity: Critical][Web app exploit]

Landmark: its business uniform online shop "Uniform Town" was accessed without authorization and card data of 63,565 customers may have leaked

The payment application was tampered with, and card data of 63,565 customers who paid by card from October 2020 to March 2022 may have leaked.

Disclosed

2022-09-26

Organizations involved

1

Leaked or at risk

63.6K

63,565

Downtime

Unknown

What happened

  1. Some card companies told it of a concern that card data had leaked. [1]

  2. It stopped card payments and started an investigation by a third-party firm. [1]

  3. It reported to the Personal Information Protection Commission and the Japan Users Association of Information Systems. [1]

  4. The investigation finished and found that card data had leaked and some may have been misused. [1]

  5. It reported the damage to the Shinjuku police station and the cybercrime unit of the Metropolitan Police Department. [1]

  6. It announced the case and began emailing the customers concerned. [1]

Impact

The card holder names, numbers, expiry dates and security codes, the personal data registered on the site and the call center records of 63,565 customers who entered new card data from October 9, 2020 to March 7, 2022 may have leaked. The company does not hold card data. [1]

Timeline

  1. Started 2020-10-09
  2. Detected 2022-07-07
  3. Disclosed 2022-09-26
  4. 717 days

Attack or cause

Method
[Web app exploit]
Impact
[Data leak]
Entry point
Web app

Data exposed or at risk

[Payment card][Name]

Organizations involved

Open in organization search

Sources

  1. [1][Official]重要なお知らせ｜ユニフォームタウンLandmark Co., Ltd. · 2022-09-26