> JapanHacked_
[Resolved][Severity: Critical][Web app exploit]

Cinque Classico: "Cinq essentiel" was accessed without authorization and card data and member data of 873 customers may have leaked

Card data and member ID, password, name, address and phone number of 873 customers who paid by card from August 2019 to August 2022 may have leaked.

Disclosed

2022-12-13

Organizations involved

1

Leaked or at risk

873

873

Downtime

Unknown

What happened

  1. A card company told it of a concern that card data had leaked. It stopped card payments on August 24. [1] [2]

  2. It reported to the Personal Information Protection Commission. [1]

  3. The investigation finished. It also notified the police on November 18. [1]

  4. It announced the case. [1] [2]

Impact

The card holder name, number, expiry date and security code, and the member ID (email address), password, name, address and phone number of 873 customers who paid by card from August 22, 2019 to August 4, 2022 may have leaked. [1] [2]

Timeline

  1. Started 2019-08-22
  2. Detected 2022-08-22
  3. Disclosed 2022-12-13
  4. 1209 days

Attack or cause

Method
[Web app exploit]
Impact
[Data leak]
Entry point
Web app

Data exposed or at risk

[Payment card][Name][E-mail address][Passwords][Postal address][Phone number]

Organizations involved

Open in organization search

Sources

  1. [1][Official]Cinqessentiel【サンクエッセンシャル】 | 弊社が運営する「Cinq essentiel」への不正アクセスによる 個人情報漏えいに関するお詫びとお知らせCinque Classico Inc. · 2022-12-13
  2. [2][News]ファッション取り扱い「Cinq essentiel」に不正アクセス、3年分の決済情報漏えいScanNetSecurity · 2022-12-19 08:05