> JapanHacked_
[Resolved][Severity: Critical][Web app exploit]

Kurashiki Hanpu: unauthorized access to its online store may have leaked 40,869 personal data records, including 8,655 card records

Card companies raised a leak concern on May 2. Its old site was accessed without authorization, and 40,869 personal data records, including 8,655 card records, may have leaked.

Disclosed

2023-08-17

Organizations involved

1

Leaked or at risk

40.9K

40,869

Downtime

Unknown

What happened

  1. It moved the online store to a new system. The unauthorized access targeted the old system before the move. [1] [2]

  2. Some credit card companies told it of a concern that card data of customers who used the site had leaked. [1] [2]

  3. It stopped card payments. [1]

  4. The investigation ended. [1]

  5. It announced the case and is contacting the customers concerned individually by email and other means. The current site runs on a fully separate system and was not affected. [1] [2]

Impact

Personal data of 40,869 records, including 8,655 credit card records, may have leaked. The card data covers March 24, 2021 to April 17, 2023. The cause is reported as tampering with the payment application. [1] [2]

Timeline

  1. Started 2021-03-24
  2. Detected 2023-05-02
  3. Disclosed 2023-08-17
  4. 876 days

Attack or cause

Method
[Web app exploit]
Impact
[Data leak]
Entry point
Web app

Data exposed or at risk

[Payment card][Name]

Organizations involved

Open in organization search

Sources

  1. [1][Official]【重要】「倉敷帆布オンラインストア」への不正アクセスによる個人情報漏洩に関するお詫びとお知らせKurashiki Hanpu Co., Ltd. · 2023-08-17
  2. [2][News]「倉敷帆布オンラインストア」に不正アクセス、8,655名のカード情報漏えいの可能性ScanNetSecurity · 2023-08-24 08:05