> JapanHacked_
[Investigating][Severity: Major][Intrusion]

FM TOKYO: the order management screen of the e-commerce platform behind the "TOKYO FM official shopping site" was accessed without authorization, and customers may have received fake re-payment emails

On January 11 the platform's order management screen was accessed and customers' personal data may have leaked. Fake emails asking for re-payment may have been sent.

Disclosed

2023-01-18

Organizations involved

1

Leaked or at risk

Unknown

Downtime

Unknown

What happened

  1. A third party accessed the order management screen of the e-commerce platform used by the shopping site. [1] [2]

  2. It announced the case. The details are still being confirmed. [1] [2]

Impact

Customers' personal data may have leaked, and a third party may have used it to send fake emails saying that a credit error had left payment incomplete and asking for payment again. Entering card data as the email directs could leak it. The company holds no card data, so none leaked from it. [1] [2]

Timeline

  1. Started, Detected 2023-01-11
  2. Disclosed 2023-01-18
  3. 7 days

Attack or cause

Method
[Intrusion]
Impact
[Data leak][Fraud]
Entry point
Unknown

Data exposed or at risk

–

Organizations involved

Open in organization search

Sources

  1. [1][Official]「ショッピングサイト」不正ログインに関するお詫びとご報告 - TOKYO FM Information - TOKYO FM 80.0MHz -FM TOKYO, Inc. · 2023-01-18
  2. [2][News]「TOKYO FM公式ショッピングサイト」に不正アクセス、再決済要求する不審メールに注意呼びかけScanNetSecurity · 2023-01-26 08:05