> JapanHacked_
[Resolved][Severity: Critical][Web app exploit]

TOMATO: the "Tomato Online Shop" was accessed without authorization and card data of 14,256 customers may have leaked

A system vulnerability was exploited and a malicious file placed, so card data of 14,256 customers may have leaked. The data management screen was also viewable.

Disclosed

2023-02-28

Organizations involved

1

Leaked or at risk

14.3K

14,256

Downtime

Unknown

What happened

  1. Some card companies told it of a concern that card data had leaked. It had a third-party investigation firm look into it. [2]

  2. The investigation finished and confirmed that unauthorized access had placed a malicious file and that purchasers' card data had leaked. [2]

  3. It announced the case. Card companies also urged cardholders to check their statements the same day. [1] [2]

Impact

Card data of 14,256 purchasers may have leaked. The cause was unauthorized access by a third party exploiting a vulnerability in part of the site's system, which placed a malicious file. The third party could also view the data management screen of the site. [2]

Timeline

  1. Started, Detected 2022-11-24
  2. Disclosed 2023-02-28
  3. 96 days

Attack or cause

Method
[Web app exploit]
Impact
[Data leak]
Entry point
Web app

Data exposed or at risk

[Payment card][Name]

Organizations involved

Open in organization search

Sources

  1. [1][News]株式会社トマト「トマトオンラインショップ」における不正アクセスによるお客様情報流出について｜楽天カードRakuten Card Co., Ltd. · 2023-02-28
  2. [2][News]生地・布の通販サイト「トマトオンラインショップ」へ不正アクセス、14,256名のカード情報が漏えいScanNetSecurity · 2023-03-06 08:05