Academia Music: its online shop's payment application was tampered with, and card data of 4,324 customers may have leaked
A weakness in its online shop was exploited to tamper with the payment application, and card data of 4,324 customers may have leaked, with some misused.
Disclosed
2024-06-18
Organizations involved
1
Leaked or at risk
Unknown
Downtime
Unknown
What happened
The police told it that customers' card data might have leaked. It took containment measures that day and on January 18 and 19. [2]
A card company told it to stop card payments, and it stopped card payments on the site the same day. It began an investigation by a third-party firm. [2]
The investigation ended and confirmed that unauthorized access through a system weakness had tampered with the payment application, leaking buyers' card data, and that some data may have been misused. [2]
Impact
Timeline
- Detected 2024-01-15
- Disclosed 2024-06-18
- 155 days
Attack or cause
- Method
- [Web app exploit]
- Impact
- [Data leak]
- Entry point
- Web app
Data exposed or at risk
Organizations involved
[Breached][Critical]Tokyo, BunkyoWholesale and retail trade4,324 leaked
Academia Music Ltd.
Sources
- [1][News]脆弱性利用され4,000件超のカード情報漏えい懸念│アカデミア・ミュージックCybersecurity.jp · 2024-06-21
- [2][News]「アカデミア・ミュージック」に不正アクセス、4,324 名のカード情報が漏えいの可能性ScanNetSecurity · 2024-06-28 08:05