> JapanHacked_
[Resolved][Severity: Critical][Web app exploit]

Babyland Tama Baby: the "EC site Babyland" was accessed without authorization and card data of 5,246 customers leaked

The payment application was tampered with and card data of 5,246 customers leaked. Card companies raised it in December 2022 and card payments on the new site were stopped.

Disclosed

2023-03-23

Organizations involved

1

Leaked or at risk

5.2K

5,246

Downtime

Unknown

What happened

  1. It closed the EC site concerned and moved to a new site. [1]

  2. Some card companies told it of a concern that card data had leaked. [1]

  3. As a precaution it stopped card payments on the new site. A third-party firm began an investigation. [1]

  4. The investigation finished. [1]

  5. It announced the case. [1]

Impact

Card data of 5,246 users of the old site leaked and some may have been misused. The cause was that a vulnerability in part of the site's system was exploited and the payment application tampered with. [1]

Timeline

  1. Started 2022-11-04
  2. Detected 2022-12-16
  3. Disclosed 2023-03-23
  4. 139 days

Attack or cause

Method
[Web app exploit]
Impact
[Data leak]
Entry point
Web app

Data exposed or at risk

[Payment card][Name]

Organizations involved

Open in organization search

Sources

  1. [1][News]「ECサイト ベビーランド」への不正アクセスで5,246名のカード情報が漏えいScanNetSecurity · 2023-04-03 08:05