> JapanHacked_
[Resolved][Severity: Critical][Web app exploit]

Stylish H&A: three sites including "COLORFUL CANDY STYLE" were accessed without authorization and card data of up to about 17,500 customers may have leaked

The payment application was tampered with, and card data of up to 17,502 customers at three sites may have leaked. The investigation took over a year.

Disclosed

2022-12-21

Organizations involved

1

Leaked or at risk

17.5K

17,502

Downtime

Unknown

What happened

  1. A card company told it of a concern that card data had leaked, and it stopped card payments the same day. [1]

  2. It reported the damage to the police, and to the Personal Information Protection Commission on January 19. [1]

  3. The investigation finished and found that a vulnerability in the Colorful Textile Market system had led to tampering with the payment application. [1]

  4. It announced the case. [1]

Impact

Card data of up to 17,472 customers at "COLORFUL CANDY STYLE" (June 26, 2020 to April 26, 2021), 23 at "BOTANY & WATERCOLORS" (July 14 to October 30, 2020) and 7 at "Colorful Textile Market" may have leaked. [1]

Timeline

  1. Started 2020-06-26
  2. Detected 2021-07-02
  3. Disclosed 2022-12-21
  4. 908 days

Attack or cause

Method
[Web app exploit]
Impact
[Data leak]
Entry point
Web app

Data exposed or at risk

[Payment card][Name]

Organizations involved

Open in organization search

Sources

  1. [1][News]「COLORFUL CANDY STYLE 公式オンラインショップ」他2サイトへ不正アクセスでカード情報漏えい、複雑性から調査に1年要すScanNetSecurity · 2022-12-23 08:05