EDUWARD Press: the payment application of its online store was tampered with, possibly exposing card data and logins of 13,433 customers

1. 2024-12-04

   The Metropolitan Police Department's cybercrime unit told it that a malicious program might be embedded in the site, and it closed the online store. The same day it confirmed the malicious program was installed. [1]

2. 2024-12-12

   It sent a first report to customers who had registered email addresses and posted a first notice on its corporate site. [1]

3. 2025-01-28

   The investigating firm finished its investigation and it confirmed that information of purchasers from March 20, 2021 to November 24, 2024 may have leaked. [1]

4. 2025-04-03

   It announced the investigation results. [1] [2]

The 13,433 people covered may have had email addresses, login passwords, card holder names, card numbers, expiry dates and security codes leaked, with card data for 13,193 of them. Some cards may also have been misused. Payments went through a payment service provider, so the company did not itself hold card data. [1]