Gintoki: payment app of its official online shop tampered with, putting data of 17,171 people and cards of 1,850 at risk

1. 2024-05-28

   The police told it the shop site might be under cyberattack. [1]

2. 2024-06-03

   It stopped card payments on the site and commissioned an external security firm for forensics. It reported to the Personal Information Protection Commission. [1]

3. 2024-07-29

   The investigation ended and confirmed that the payment app had been tampered with through a vulnerability, possibly leaking card data entered at order time. [1]

4. 2024-11-25

   It announced the case and said it would contact those concerned individually by email and letter. [1] [2]

The 1,850 people who paid by card between June 28, 2021 and May 30, 2024 may have had card numbers, expiry dates and security codes leaked. Personal data of 17,171 people in all is covered, including names, addresses, phone numbers, email addresses, login passwords and birth dates of members, names and addresses of buyers and recipients, and details on reservation slips for in-store events from 2017 to 2020. [1]