> JapanHacked_
[Resolved][Severity: Critical][Web app exploit]

Platinum Style: "PARTY DRESS STYLE" was accessed without authorization and card data of 8,604 customers may have leaked

A system vulnerability was exploited and the payment application tampered with, so card data of 8,604 customers who paid from October 2021 to June 2022 may have leaked.

Disclosed

2023-03-02

Organizations involved

1

Leaked or at risk

8.6K

8,604

Downtime

Unknown

What happened

  1. Some card companies told it of a concern that card data had leaked. It stopped card payments and began an investigation by a third-party firm. [1]

  2. The investigation finished and confirmed that the payment application had been tampered with, card data had leaked and some may have been misused. [1]

  3. It announced the case. It explained that it had waited for the investigation result and coordination with the card companies so as not to cause confusion with unconfirmed information, which delayed the announcement. [1] [2]

Impact

The card holder name, number, expiry date, security code, IP address and email address of 8,604 customers who paid by card from October 21, 2021 to June 20, 2022 may have leaked. Customers who paid with Amazon Pay are not affected. The cause was that a vulnerability in part of the system was exploited and the payment application tampered with. [1] [2]

Timeline

  1. Started 2021-10-21
  2. Detected 2022-06-20
  3. Disclosed 2023-03-02
  4. 497 days

Attack or cause

Method
[Web app exploit]
Impact
[Data leak]
Entry point
Web app

Data exposed or at risk

[Payment card][Name][E-mail address]

Organizations involved

Open in organization search

Sources

  1. [1][Official]「PARTY DRESS STYE」不正アクセスによる個人情報流出に関するお詫びとお知らせ - 結婚式のドレスレンタルはパーティドレススタイルPlatinum Style Inc. · 2023-03-02
  2. [2][News]「PARTY DRESS STYLE」に不正アクセス、8,604名のカード情報が漏えいScanNetSecurity · 2023-03-08 08:05