Kanko Gakuseifuku: card data of 3,894 customers may have leaked from its online shop
School uniform maker Kanko Gakuseifuku (Okayama) announced on 4 March 2024 that its "Kanko online shop Harajuku Select Square" had been accessed without authorization and that card data may have leaked. A card company raised a leak concern on 27 September 2023 and card payments were stopped; a third-party investigation completed on 8 December found that the payment application had been tampered with through unauthorized access exploiting a weakness in the system. Names, phone numbers, addresses, birth dates, card numbers, expiry dates and security codes of customers who paid by card between 25 April 2021 and 21 August 2023 are affected, and some cards may have been misused. The count was updated from 3,827 at the announcement to 3,894. The old site had been closed on 22 August 2023, and the school e-commerce and other systems are separate and not affected.
Disclosed
2024-03-04
Organizations involved
1
Leaked or at risk
3.9K
3,894
Downtime
Unknown
Timeline
- Detected 2023-09-27
- Disclosed 2024-03-04
- 159 days
Attack or cause
- Method
- [Web app exploit]
- Impact
- [Data leak][Fraud]
- Entry point
- Web app
Data exposed or at risk
Services hit
Organizations involved
[Breached][Critical]Okayama, KurashikiManufacturing3,894 leaked
Kanko Gakuseifuku Co., Ltd.
Sources
- [1][Official]弊社が運営する「カンコーオンラインショップ原宿セレクトスクエア」への不正アクセスによる個人情報漏えいに関するお詫びとお知らせKanko Gakuseifuku · 2024-03-04