Sankei: personal data of 292,707 customers, including card data of 71,943, may have leaked from its old online shop

Sankei, a lingerie retailer and mail-order seller in Setagaya, Tokyo, announced on 9 December 2024 that the old version of its online shop (since closed) had been accessed without authorization and that personal data of 292,707 customers, including card data of 71,943, may have leaked. A card company raised a leak concern on 26 June, and card payments on the current site were also stopped on 16 July. A third-party investigation completed on 24 September found that the payment application had been tampered with through unauthorized access exploiting a weakness in the old site. Affected are card holder names, numbers, expiry dates, security codes, email addresses, postcodes and phone numbers of 71,943 customers who paid by card between 27 December 2019 and 15 May 2024, and names, birth dates, gender, addresses, phone numbers, email addresses, encrypted login passwords and order details of 292,707 customers who used the old site by 15 May; some cards may have been misused.