Tully's: intrusion at its online store; payment app tampering may have leaked over 50,000 cards

On 30 May 2024 Tully's Coffee Japan disclosed unauthorized access to its Tully's Online Store. On 20 May the Tokyo Metropolitan Police told it of a suspected card data leak; it stopped card payments that day and closed the site on 23 May. Its findings of 3 October said a vulnerability in part of the system had been exploited to tamper with the payment application. Names, addresses, phone numbers, gender, birth dates, email addresses, login IDs, passwords and more of 92,685 members, and the card numbers, holder names, expiry dates and security codes of 52,958 people who paid by card from 20 July 2021 to 20 May 2024, may have leaked.