Gujo Hachiman Industrial Promotion Corporation: the payment application of its "Gujo Hachimanya" shop was tampered with, and 2,972 card records and up to 6,920 personal records may have leaked
A tampered payment app on its online shop, found after a police tip, may have leaked 2,972 card records and up to 6,920 personal records. It was announced 14 months later.
Disclosed
2025-08-04
Organizations involved
1
Leaked or at risk
6.9K
6,920
Downtime
Unknown
What happened
The Gifu prefectural police told it that card data of customers who used the shop might have leaked. [3]
It suspended card payments on the site and had a third-party investigation firm start work. [3]
The investigation finished and confirmed that an unauthorized access exploiting a system flaw had tampered with the payment application and leaked card data. [3]
It announced the incident. It said it had waited for the investigation results and coordination with card companies. [1] [2] [3]
Impact
Personal data such as names and addresses of up to 6,920 records, and 2,972 credit card records (card numbers, security codes and more), of customers who used the site from March 28, 2021 to May 17, 2024 may have leaked. Some cards may have been used fraudulently. [2] [3]
Timeline
- Started 2021-03-28
- Detected 2024-05-15
- Disclosed 2025-08-04
- 1590 days
Attack or cause
- Method
- [Web app exploit]
- Impact
- [Data leak]
- Entry point
- Web app
Data exposed or at risk
Organizations involved
[Breached][Critical]Gifu, GujoWholesale and retail trade2,972 leaked
Gujo Hachiman Industrial Promotion Corporation
Sources
- [1][Official]「郡上八幡屋-特産品通販-」への不正アクセスによる個人情報漏えいに関するお詫びとお知らせGujo Hachiman Industrial Promotion Corporation · 2025-08-04
- [2][News]【2025年8月】注目のインシデントニュース|情報漏えい事例5選|サイバーセキュリティラボCybersecurity Lab · 2025-09-30
- [3][News]「郡上八幡屋-特産品通販-」への不正アクセスで 2,972 名のカード情報が流出、岐阜県警から 2024 年 5 月 15 日に漏えい懸念の連絡ScanNetSecurity · 2025-08-19 08:05