> JapanHacked_
[Resolved][Severity: Critical][Web app exploit]

Tsuno Food Industrial: the "Tsuno Food web shop" was accessed without authorization and 2,086 card records leaked

An injection attack from an overseas IP address tampered with the payment application, and 2,086 card records leaked. Some may have been misused.

Disclosed

2022-12-26

Organizations involved

1

Leaked or at risk

2.1K

2,086

Downtime

Unknown

What happened

  1. Some card companies told it of a concern that card data had leaked, and it stopped card payments the same day. It also reported to the Personal Information Protection Commission. [1] [2]

  2. The investigation by a third-party firm finished. It also notified the police. [1] [2]

  3. It announced the case. [1] [2]

Impact

Card data of 2,086 purchases paid by card from March 19, 2021 to February 27, 2022 leaked. An injection attack from an overseas IP address tampered with the payment application, and some data may have been misused. [1] [2]

Timeline

  1. Started 2021-03-19
  2. Detected 2022-11-22
  3. Disclosed 2022-12-26
  4. 647 days

Attack or cause

Method
[Web app exploit]
Impact
[Data leak]
Entry point
Web app

Data exposed or at risk

[Payment card][Name]

Organizations involved

Open in organization search

Sources

  1. [1][Official]お知らせ20230413Tsuno Food Industrial Co., Ltd. · 2022-12-26
  2. [2][News]「つの食品webショップ」へ不正アクセスでカード情報漏えい、1ヶ月で調査終了 スピード公表ScanNetSecurity · 2022-12-29 08:05