Sojitz Infinity: the "TOMS Official Store" was accessed without authorization and 3,840 card records leaked

1. 2022-10-01

   The store had ended sales on August 31, 2022 and was closed on this day. [1]

2. 2022-11-29

   Card companies told it of a concern that card data had leaked, and it reported to the Personal Information Protection Commission the next day. [1]

3. 2022-12-15

   An external investigation firm began its investigation, which ran until January 11, 2023. [1]

4. 2023-02-01

   It notified the police. [1]

5. 2023-02-15

   It announced the case. [1] [2]

The card holder name, number, expiry date and security code of 3,840 purchases paid by card from April 22, 2021 to August 31, 2022 leaked. In addition, personal data of 36,311 records may have leaked: name, address, phone number, email address, sex, birth date, fax number and company name. The cause was that a system vulnerability was exploited and a data-stealing tool installed. [1] [2]