> JapanHacked_
[Contained][Severity: Critical][Web app exploit]

Interix: card data leaked from the Just Curtain online shop

Attackers exploited a vulnerability in the Just Curtain online shop run by Interix and tampered with its payment application. Card data (number, expiry, security code) of 10,423 customers who paid by card from 30 April 2024 to 24 May 2025, and names, addresses, phone numbers, emails, passwords and birth dates of 60,663 buyers and members since June 2019, may have leaked. A card company alerted the shop on 21 May 2025; the leak was disclosed on 26 January 2026.

Disclosed

2026-01-26

Organizations involved

1

Leaked or at risk

60.7K

60,663

Downtime

Unknown

Timeline

  1. Detected 2025-05-21
  2. Disclosed 2026-01-26
  3. 250 days

Attack or cause

Method
[Web app exploit]
Impact
[Data leak][Fraud]
Entry point
Web app

Data exposed or at risk

[Name][Postal address][Phone number][E-mail address][Passwords][Date of birth][Payment card]

Services hit

Organizations involved

Open in organization search

Sources

  1. [1][Official]弊社が運営する「ジャストカーテンオンラインショップ」への不正アクセスによる個人情報漏えいに関するお詫びとお知らせInterix · 2026-01-26