Inageya: the QR code on its net supermarket sign-up posters led to a fraudulent site and card data of some customers was stolen
The QR code on posters and flyers at two Kawasaki stores led to an unintended fraudulent site. From October 27 to November 9, card data of some customers was stolen.
Disclosed
2023-11-09
Organizations involved
1
Leaked or at risk
Unknown
Downtime
Unknown
What happened
From this day until November 9, scanning the QR code on the net supermarket sign-up posters and flyers at the Kawasaki Dobashi and Kawasaki Shimokodanaka stores led to an unintended fraudulent site. [1] [2]
It announced the case, saying some customers had their credit card data stolen. The cause is under investigation. [1] [2]
Impact
The fraudulent site showed a screen with the text "netsuper.rakuten.co.jp" and an "OK" button, or a screen reading "mobile activation". It tells people to close such screens at once and asks anyone affected to contact their credit card company. The number of victims has not been published. [1]
Timeline
- Started 2023-10-27
- Detected, Disclosed 2023-11-09
- 13 days
Attack or cause
- Method
- [Unknown]
- Impact
- [Fraud][Data leak]
- Entry point
- Unknown
Data exposed or at risk
Organizations involved
[Breached][Major]Tokyo, TachikawaWholesale and retail trade
Inageya Co., Ltd.
Sources
- [1][News]「いなげや」QRコードから不正サイトに誘導、カード情報抜き取られる被害ITmedia NEWS · 2023-11-10
- [2][News]いなげやのネットスーパー入会案内記載 QRコード、不正サイト誘導広告が表示されカード情報が抜き取り被害ScanNetSecurity · 2023-11-17 08:05