CREATEs: personal data of 65,520 customers and some card data may have leaked from its former shop

On 20 February 2024 the hair appliance maker CREATEs in Fukuoka announced that its "CREATEs official online shop" had been accessed without authorization and that personal data of 65,520 customers and card data of a smaller customer cohort may have leaked. An outsider is believed to have used a fraudulent order exploiting a weakness in the old site to tamper with it and plant a program that stole data as it was entered. A card company alerted it on 1 June 2023 and the investigation finished on 26 July. Card holder names, numbers, expiry dates and security codes of customers who paid by card on the old site between 21 April 2021 and 3 April 2023 are affected; the notice gives the count as 4,748 in its opening and 4,583 in the details. Names, birth dates, gender, addresses, phone numbers, email addresses and login passwords are also affected. Some cards may have been misused.