[Resolved][Severity: Critical][Misconfiguration]

Demae-Can: a flaw in third-party account linkage may have shown account data of other customers on a shared device, with the count revised to 9.24 million accounts

A flaw in third-party account linkage may have shown names, addresses and other data of other customers on a shared device. The count grew from 250,000 to 9.24 million accounts.

Disclosed

2023-03-24

Organizations involved

Leaked or at risk

9.2M

9,244,553

Downtime

Unknown

What happened

2023-03-23
It fixed the flaw in the account linkage system with a system update. [1] [2]
2023-03-24
It announced the flaw found in an internal investigation, putting the number of target accounts at 252,860. Credit card data is not included. [1] [3]
2023-06-23
It published a follow-up and revised the number of potentially affected accounts to 9,244,553. It is notifying, in turn, customers who were outside the earlier scope. [2] [3]

Impact

When a customer linked a third-party account without being logged in to Demae-Can, another customer then logged in on the same PC or smartphone, and the first customer chose "log in with the linked account", part of the later customer's account data could be viewed. The affected period is 2020 to March 23, 2023, and the data is name, date of birth, gender, address, phone number and email address. The company says the count includes many cases, such as families sharing a device, in which no improper viewing took place. No misuse has been confirmed. [1] [2] [3]