Sharp: unauthorized access to COCORO STORE and Healsio Deli leaked data of 5,836 customers, with card data of 4,257 possibly leaked

1. 2024-07-19 04:19

   From this time until 10:50 on July 22, the COCORO STORE website was tampered with and a program was planted that stole card and other information entered when an order was confirmed. [1]

2. 2024-07-22

   It detected the tampering of COCORO STORE. The same day it stopped COCORO STORE and Healsio Deli and halted card payments. [1]

3. 2024-07-26

   It reported to the Personal Information Protection Commission and notified the Osaka Prefectural Police. [1]

4. 2024-07-29

   It announced the case, saying part of its order information had been taken and personal data of 203 people had leaked. [1]

5. 2024-10-16

   The investigation by an external specialist body ended. [1]

6. 2024-10-30

   It published the results. It confirmed that exploitation of a software flaw was the cause, and that 5,836 people may have had personal data leaked, 4,257 of them including card data. It said it would contact those affected individually by email and letter. [1] [2]

Of the customers who confirmed orders between July 19 and 22, 4,257 may have had their cardholder name, card number, expiry date, security code, address, name, phone number, email address and password leaked. For 1,376 the data is address, name, phone number, email address and password without card data. The remaining 203 had order information from some June orders leaked, without card data. [1]