Smartshare: unauthorized access to the OWNLY SNS campaign tool leaks Mos campaign entrants' data

On 27 October, Smartshare said a flaw in the file upload function of its SNS campaign tool OWNLY let an attacker in, and entrant data was viewed and downloaded. Its monitoring caught the intrusion early on 16 October; a notification setting delayed the response, but the route was closed the same day. The leak covers 14,034 entries in three Mos Burger campaigns (the Mos receipt challenge, a Mos Halloween giveaway and a VALX × Mos Burger collaboration): X or LINE user names and IDs, entry times, and draw and coupon status. Names, addresses, phone numbers, email addresses and card data were not collected. It reported to the Personal Information Protection Commission and the Ministry of Internal Affairs and Communications on 21 October.