Kadoya: the "Kadoya Official Online Shop" was accessed without authorization and card data of up to 6,263 customers may have leaked

1. 2021-04-30

   The period in which data could be affected began. Users who registered card data on the old-environment site from this day to March 1, 2023 are concerned. [1]

2. 2023-03-01

   It suspended payments on the old-environment site where the concern was found and the same day rebuilt it on a different platform and payment system. [1]

3. 2023-03-15

   Some credit card companies told it of a concern that card data of users of the old-environment site had leaked. [1]

4. 2023-03-20

   An investigation by a third-party research firm began. [1]

5. 2023-03-24

   On the instruction of some card companies it suspended some card payments. [1]

6. 2023-04-08

   The third-party investigation finished. [1]

7. 2023-05-17

   It announced the case. [1] [2]

The cause was that a third party exploited a vulnerability in the system of the site it operates, entered the server and tampered with the payment application. For up to 6,263 people who registered card data from April 30, 2021 to March 1, 2023, the cardholder name, card number, expiry date and security code may have leaked, and some may have been misused. Names, addresses, postal codes, phone numbers, email addresses and purchase history (including optional company name, fax number, sex and birth date) of up to 28,658 people who used the site in the past may also have leaked. It continues to monitor for misuse with the card companies and will not charge users reissue fees. [1] [2]