> JapanHacked_
[Resolved][Severity: Critical][Web app exploit]

Katayama Shoji: the payment application of the "Nature Katayama Online Store" was tampered with, leaking 1,049 card records

A flaw let attackers tamper with the payment application, leaking customers' personal data and 1,049 card records, some of which may have been misused.

Disclosed

2025-10-22

Organizations involved

1

Leaked or at risk

1K

1,049

Downtime

Unknown

What happened

  1. JPCERT/CC told the company that the card data of customers who used the store might have leaked. [1] [2]

  2. It shut down the site and had a third-party investigator look into it. [1] [2]

  3. The investigation finished and confirmed that an attack through a flaw in part of the system had tampered with the payment application and leaked personal and card data, some of which may have been misused. [1] [2]

  4. Katayama Shoji announced the leak. [1] [2]

Timeline

  1. Detected 2024-11-22
  2. Disclosed 2025-10-22
  3. 334 days

Attack or cause

Method
[Web app exploit]
Impact
[Data leak]
Entry point
Web app

Data exposed or at risk

[Payment card][Name]

Organizations involved

Open in organization search

Sources

  1. [1][Official]弊社が運営する「ナチュレ片山オンラインストア」への不正アクセスによる個人情報漏えいに関するお詫びとお知らせKatayama Shoji Co., Ltd. · 2025-10-22
  2. [2][News]「ナチュレ片山オンラインストア」に不正アクセス、1,049 件のカード情報が漏えいScanNetSecurity · 2025-11-10 08:05