Karel Capek: personal data of 103,289 members and 58,407 card records may have leaked from its online store
Tea shop Karel Capek posted a notice on its website on 5 June 2024 about a possible card data leak from its "Karel Capek tea shop official online store". A system vendor raised the concern on 22 May and the site was stopped on 30 May. Its announcement of 30 October said a third-party investigation completed on 9 September found that the payment application had been tampered with through unauthorized access exploiting a weakness in the site. Names, addresses, phone numbers, birth dates, email addresses, login IDs, passwords and delivery addresses of 103,289 members who registered between 26 April 2020 and 21 May 2024, and 58,407 card records (holder names, numbers, expiry dates, security codes) from the same period, are affected.
Disclosed
2024-06-05
Organizations involved
1
Leaked or at risk
103.3K
103,289
Downtime
Unknown
Timeline
- Detected 2024-05-22
- Disclosed 2024-06-05
- 14 days
Attack or cause
- Method
- [Web app exploit]
- Impact
- [Data leak]
- Entry point
- Web app
Data exposed or at risk
Services hit
Organizations involved
[Breached][Critical]Tokyo, ShibuyaWholesale and retail trade103,289 leaked
Karel Capek Inc.
Sources
- [1][News]「カレルチャペック紅茶店公式通販サイト」に不正アクセス、延べ 58,407 名のカード情報を漏えい懸念対象と結論付けるScanNetSecurity · 2024-11-07
- [2][News]カレルチャペック紅茶店、延べ5.8万件のクレジットカード情報漏えいかASCII.jp