Future Shop: unauthorized access to its servers

At about 10:14 on October 21, Future Shop, which runs the futureshop e-commerce platform, found unauthorized access to four servers (c02, c05, c12 and g06) and put them into maintenance from 11:30, so shops on them lost their storefronts, admin screens, FTP and API. After closing the entry point and rebuilding the servers, it resumed service at 23:35 on October 22. On October 23 it disclosed a separate intrusion: at 23:02 on October 17 an attacker exploited a vulnerability in software on its servers and at 00:16 on October 18 took 3,147,469 member records of one shop. Monitoring caught it at about 15:30 on October 19. The data includes member IDs, names, email addresses, addresses, birth dates, phone numbers, genders and hashed passwords, but no card data. On 23 October Lindt & Sprüngli Japan said the shop was its official online shop and app. On 26 October it force-reset affected members' passwords and pulled its app from the app stores for the time being.