> JapanHacked_
[Contained][Severity: Critical][Web app exploit]

Marukawamiso: card data (5,447 records) and personal data of 89,673 customers may have leaked from its official shop

Fukui miso maker Marukawamiso announced on 2 April 2024 that its "Marukawamiso official site" had been accessed without authorization and that 5,447 card records and personal data of 89,673 customers may have leaked. A card company raised a leak concern on 6 November 2023 and card payments were stopped; a third-party investigation completed on 20 December found that the payment application had been tampered with through unauthorized access exploiting a weakness in the system. Card holder names, numbers, expiry dates and security codes of 4,851 customers who paid by card or registered or changed a card on their account page between 11 March and 13 November 2023, and names, email addresses, addresses, phone numbers, purchase histories and more of 89,673 buyers and members since the site opened, are affected. A fake card entry form had also been planted. On 7 May it added that login passwords of 20,606 account page users may also have leaked.

Disclosed

2024-04-02

Organizations involved

1

Leaked or at risk

89.7K

89,673

Downtime

Unknown

Timeline

  1. Detected 2023-11-06
  2. Disclosed 2024-04-02
  3. 148 days

Services hit

Organizations involved

Open in organization search

Sources

  1. [1][Official]当サイトへの不正アクセスによる個人情報漏洩に関するお詫びとお知らせMarukawamiso · 2024-04-02
  2. [2][Official]当サイトへの不正アクセスに関する追加のお知らせMarukawamiso · 2024-05-07
  3. [3][News]マルカワみそで個人情報約9万人分が流出、原因は決済アプリの改ざんNikkei xTECH