[Resolved][Severity: Critical][Web app exploit]

Sekaido: the server of the contractor managing its online shop was accessed without authorization, and up to 186,704 member email addresses leaked

On August 19 a vulnerability in the contractor's server was exploited and up to 186,704 member email addresses leaked. Names, addresses and card data are not included.

Disclosed

2022-09-16

Organizations involved

Leaked or at risk

Unknown

Downtime

Unknown

What happened

2022-08-19
The unauthorized access was found, the vulnerability of the server was identified and access control was strengthened the same day. [1]
2022-09-16
It announced the case. It had reported to the Personal Information Protection Commission and the police. [1]

Impact

Up to 186,704 email addresses of members registered by August 19 leaked. Names, addresses, phone numbers, passwords, order history and payment information did not leak. [1]

Timeline

Detected 2022-08-19
Disclosed 2022-09-16
28 days

Attack or cause

Method: [Web app exploit]
Impact: [Data leak]
Entry point: Supplier

Data exposed or at risk

[E-mail address]

Supply chain

[Breached]

Sekaido Co., Ltd.

[Breached]

Sekaido Co., Ltd.

Organizations listed on this site: 1

Organizations involved

[Through a supplier][Critical]Tokyo, ShinjukuWholesale and retail trade186,704 leaked
Sekaido Co., Ltd.
The server of the company managing its e-commerce system was attacked.

						Note
Sekaido Co., Ltd.	[Through a supplier]	[Critical]	Tokyo, Shinjuku	Wholesale and retail trade	186,704	The server of the company managing its e-commerce system was attacked.

Open in organization search

Sources

[1][News]世界堂オンラインショップに不正アクセス　メアド最大18万件が流出 - ITmedia NEWSITmedia NEWS · 2022-09-26