> JapanHacked_
[Contained][Severity: Critical][Web app exploit]

Academia Music: its online shop's payment application was tampered with, and card data of 4,324 customers may have leaked

A weakness in its online shop was exploited to tamper with the payment application, and card data of 4,324 customers may have leaked, with some misused.

Disclosed

2024-06-18

Organizations involved

1

Leaked or at risk

Unknown

Downtime

Unknown

What happened

  1. The police told it that customers' card data might have leaked. It took containment measures that day and on January 18 and 19. [2]

  2. A card company told it to stop card payments, and it stopped card payments on the site the same day. It began an investigation by a third-party firm. [2]

  3. The investigation ended and confirmed that unauthorized access through a system weakness had tampered with the payment application, leaking buyers' card data, and that some data may have been misused. [2]

  4. It announced the case. [1] [2]

Impact

Card data of 4,324 customers may have leaked. News reports also say there are leak concerns over 4,696 card records and over login passwords, addresses, contact details and occupations of 2,092 members. It stopped card payments and reset members' passwords. [1] [2]

Timeline

  1. Detected 2024-01-15
  2. Disclosed 2024-06-18
  3. 155 days

Organizations involved

Open in organization search

Sources

  1. [1][News]脆弱性利用され4,000件超のカード情報漏えい懸念│アカデミア・ミュージックCybersecurity.jp · 2024-06-21
  2. [2][News]「アカデミア・ミュージック」に不正アクセス、4,324 名のカード情報が漏えいの可能性ScanNetSecurity · 2024-06-28 08:05