Kishiwada Sports: card data of 13,960 and personal data of 38,664 KISHISPO customers may have leaked

On 14 May 2024 Kishiwada Sports, a football goods retailer in Kishiwada, Osaka, announced that its online store "Kemari87KISHISPO" had been accessed without authorization and that card and personal data may have leaked. An outsider placed fraudulent orders between 21 and 24 February 2021 and, starting from viewing the order data, exploited a weakness in the site to run a malicious script. Affected are card holder names, numbers, expiry dates, security codes, email addresses, addresses and phone numbers of customers who paid by card between 24 February 2021 and 17 January 2024, and names, email addresses, addresses and phone numbers of all buyers in that period. The card count, first given as 13,879, was corrected to 13,960 in June. According to the company's Q&A, Osaka police alerted it on 17 January.