> JapanHacked_
[Contained][Severity: Critical][Web app exploit]

Kanko Gakuseifuku: card data of 3,894 customers may have leaked from its online shop

School uniform maker Kanko Gakuseifuku (Okayama) announced on 4 March 2024 that its "Kanko online shop Harajuku Select Square" had been accessed without authorization and that card data may have leaked. A card company raised a leak concern on 27 September 2023 and card payments were stopped; a third-party investigation completed on 8 December found that the payment application had been tampered with through unauthorized access exploiting a weakness in the system. Names, phone numbers, addresses, birth dates, card numbers, expiry dates and security codes of customers who paid by card between 25 April 2021 and 21 August 2023 are affected, and some cards may have been misused. The count was updated from 3,827 at the announcement to 3,894. The old site had been closed on 22 August 2023, and the school e-commerce and other systems are separate and not affected.

Disclosed

2024-03-04

Organizations involved

1

Leaked or at risk

3.9K

3,894

Downtime

Unknown

Timeline

  1. Detected 2023-09-27
  2. Disclosed 2024-03-04
  3. 159 days

Attack or cause

Method
[Web app exploit]
Impact
[Data leak][Fraud]
Entry point
Web app

Data exposed or at risk

[Name][Phone number][Postal address][Date of birth][Payment card]

Services hit

Organizations involved

Open in organization search

Sources

  1. [1][Official]弊社が運営する「カンコーオンラインショップ原宿セレクトスクエア」への不正アクセスによる個人情報漏えいに関するお詫びとお知らせKanko Gakuseifuku · 2024-03-04