> JapanHacked_
[Resolved][Severity: Critical][Web app exploit]

Gujo Hachiman Industrial Promotion Corporation: the payment application of its "Gujo Hachimanya" shop was tampered with, and 2,972 card records and up to 6,920 personal records may have leaked

A tampered payment app on its online shop, found after a police tip, may have leaked 2,972 card records and up to 6,920 personal records. It was announced 14 months later.

Disclosed

2025-08-04

Organizations involved

1

Leaked or at risk

6.9K

6,920

Downtime

Unknown

What happened

  1. The Gifu prefectural police told it that card data of customers who used the shop might have leaked. [3]

  2. It suspended card payments on the site and had a third-party investigation firm start work. [3]

  3. The investigation finished and confirmed that an unauthorized access exploiting a system flaw had tampered with the payment application and leaked card data. [3]

  4. It announced the incident. It said it had waited for the investigation results and coordination with card companies. [1] [2] [3]

Impact

Personal data such as names and addresses of up to 6,920 records, and 2,972 credit card records (card numbers, security codes and more), of customers who used the site from March 28, 2021 to May 17, 2024 may have leaked. Some cards may have been used fraudulently. [2] [3]

Timeline

  1. Started 2021-03-28
  2. Detected 2024-05-15
  3. Disclosed 2025-08-04
  4. 1590 days

Attack or cause

Method
[Web app exploit]
Impact
[Data leak]
Entry point
Web app

Data exposed or at risk

[Name][Postal address][Payment card]

Organizations involved

Open in organization search

Sources

  1. [1][Official]「郡上八幡屋-特産品通販-」への不正アクセスによる個人情報漏えいに関するお詫びとお知らせGujo Hachiman Industrial Promotion Corporation · 2025-08-04
  2. [2][News]【2025年8月】注目のインシデントニュース|情報漏えい事例5選|サイバーセキュリティラボCybersecurity Lab · 2025-09-30
  3. [3][News]「郡上八幡屋-特産品通販-」への不正アクセスで 2,972 名のカード情報が流出、岐阜県警から 2024 年 5 月 15 日に漏えい懸念の連絡ScanNetSecurity · 2025-08-19 08:05