Nakahora Farm: former shop compromised; 5,069 card records and personal data of 14,933 customers at risk

On 28 February 2024 Nakahora Farm announced that the old site of its online store had been accessed without authorization on 22 April 2021, that card data of 5,069 customers entered up to 11 July 2023 may have been stolen, and that personal data of 14,933 customers, including those, may have been viewed. A weakness in the old site's system was exploited to tamper with the payment application. A card company alerted it on 8 September 2023; it stopped card payments on the current site on 12 September, and a third-party investigation ended on 27 November. Card holder names, numbers, expiry dates, security codes and addresses are affected, as are names, email addresses, birth dates, phone numbers and order details; some cards may have been misused. The card cohort also includes customers who updated card data on the old site's My Page between 12 July and 12 September 2023.