Fine Aid: unauthorized access to its mail-order site "Kenko Ikiiki Lifestyle", and card data of 5,193 people may have leaked

1. 2023-12-11

   Some credit card companies told it of a concern about leaked personal data of customers who used the site. [1] [2]

2. 2023-12-12

   It stopped card payments on the site and began an investigation by a third-party body. It reported to the Personal Information Protection Commission and filed a report with the police. [1] [2]

3. 2023-12-26

   The investigation finished and confirmed that a cross-site scripting flaw was exploited to tamper with the application that handles personal data at payment. [1] [2]

4. 2024-01-31

   It announced the case and began contacting affected customers individually by email or letter. [1] [2]

The data of 5,193 people who used the site from January 5, 2021 to November 15, 2023 is affected. Cardholder names, card numbers, expiry dates, security codes, names, addresses, email addresses, phone and fax numbers, order history, birth dates and gender may have leaked. The site moved to a new environment on November 15, 2023, but card payments remain stopped. [1] [2]