Shimogamo Saryo: card data of 16,682 and personal data of 19,235 customers may have leaked from its online shop

Kyoto restaurant Shimogamo Saryo disclosed on 18 July 2024 that its "Shimogamo Saryo online shop" may have been compromised by unauthorized access. A card company raised a leak concern on 16 July and card payments were stopped. Its findings of 31 October said the payment application had been tampered with through unauthorized access exploiting a weakness in the system. Names, addresses, phone numbers, gender, birth dates, email addresses and more of 19,235 members registered by 13 May 2024, and card holder names, numbers, expiry dates and security codes of 16,682 customers who paid by card between 12 June 2021 and 13 May 2024, may have leaked. Some cards may have been misused. No leak was found in the new system it moved to on 14 May. According to Nikkei xTECH, the shop was hit by a cross-site scripting attack.