Showcase: the code of its form-input services was rewritten, and card data entered on customer sites may have leaked

1. 2022-07-19

   From this day to July 29, information entered in the input forms of customer sites was taken. [4]

2. 2022-07-26

   A business partner pointed out that the service code looked wrong. [1]

3. 2022-07-28

   Showcase told customers such as ABC-MART, U-CAN and FUJIFILM Imaging Systems of the concern that card data had leaked. [2] [3] [4]

4. 2022-08-09

   ABC-MART stopped card payments. U-CAN and FUJIFILM Imaging Systems stopped them on August 12. [2] [3] [4]

5. 2022-10-25

   Showcase announced that a vulnerability had been exploited and the source code rewritten. ABC-MART announced the same day. [1] [2]

6. 2022-10-26

   U-CAN and FUJIFILM Imaging Systems announced the case. Idemitsu Credit also published a follow-up. [3] [4] [6]

7. 2022-11-01

   Kakuyasu announced that card data of 8,094 records had leaked from its online shop. [10] [11]

8. 2022-11-10

   S&B Foods announced that card data of 164 customers of its "Otodoke Site" may have leaked. [8]

9. 2022-11-15

   Nippon Shuppan Hanbai announced that card data of 427 records at "Honya Club.com" may have leaked. [9]

10. 2023-01-10

    Covermark announced that card data of 2,259 records at its official online shop may have leaked. [12]

11. 2023-01-24

    Charle announced that card data at its "CHARLE WEB STORE" may have leaked. [13] [14]

The code of three Showcase services, "Form Assist", "Site Personalizer" and "Smartphone Converter", was rewritten. Card data entered on customer sites that used them may have leaked. [1] [7]

Among the customer sites, card data of 2,298 records at ABC-MART (July 24 to 26), 200 at U-CAN (July 24 to 26) and 1,370 at FUJIFILM Imaging Systems (851 at "FUJIFILM Print & Gift" and 519 at "Fujifilm Mall", July 19 to 29) may have leaked. The card application screens of Idemitsu Credit had the same cause, and its follow-up corrected the period of possible leak. [2] [3] [4] [5] [6]

Later, the companies announced that card data may have leaked from the "Kakuyasu Net Shopping" of Kakuyasu (8,094 records, July 19 7:50 to July 29 1:49), the "Otodoke Site" of S&B Foods (164 customers, July 19 to 29) and "Honya Club.com" of Nippon Shuppan Hanbai (427 records, July 19 to 28). The data concerned is the card number, expiry date and security code. [8] [9] [10] [11]

Later, Covermark announced that the card number, expiry date and security code of 2,259 purchases paid by card at its official online shop from July 19 to 26, 2022 may have leaked. The cause was the tampering with the "Form Assist" and "Site Personalizer" programs. [12]

Later, Charle announced that the card holder name, number, expiry date and security code of 605 customers who paid by card at its "CHARLE WEB STORE" from July 19 to 29, 2022 may have leaked. Its own site was not tampered with. It stopped card payments on August 3, 2022. [13] [14]