[Contained][Severity: Major][Web app exploit]

Sengoku Densho: SQL injection into its online shop "Sengoku Net Tsuhan" leaked email addresses of buyers and users

An SQL injection hit its online shop on April 8 and leaked email addresses of buyers and users. Card data is handled by a payment provider and did not leak.

Disclosed

2023-04-11

Organizations involved

Leaked or at risk

Unknown

Downtime

Unknown

What happened

2023-04-08
Unauthorized access to the online shop took place. [2]
2023-04-11
It announced that, after customers pointed out receiving spam and an internal investigation, it found that email addresses of buyers and users had leaked. [2]
2023-04-14
It explained the scope of the leak. Checks of login records and malware on work PCs showed no sign of intrusion. Web server access records showed traces of SQL injection, and the attack queries covered only table information and the email address column of the personal data table, so it judged that only email addresses leaked. [1]

Impact

Only email addresses leaked, and customers who have ordered since 2006 are covered. Credit card data is processed on a payment provider's site and is neither passed through nor held by the company, so it could not have leaked. [1] [2]