Shimane Products Association: Shimane Furusato Chokusobin shop breached; card data of 7 people may have been exposed

1. 2026-08-13

   At about 15:30, a flaw in the Amazon Pay plugin of the EC-CUBE platform behind Shimane Furusato Chokusobin was exploited: a rogue admin account was created and a file that reads payment page input was planted. [1]

2. 2026-08-14

   Warned by the platform provider, the site maintenance contractor found the intrusion, deleted the rogue account and disabled the plugin. [1]

3. 2026-08-15

   At about 10:50 the planted file was replaced with the original. [1]

4. 2026-10-23

   The association emailed the affected users. [1]

5. 2026-11-02

   Shimane Prefecture, which contracts the shop, disclosed the case. [1] [2]

Card numbers, expiry dates, cardholder names and security codes of 7 people (6 of whom completed a purchase) who entered payment details between about 15:30 on 13 August and 10:50 on 15 August were viewable for a time. No record of data being sent out has been found, and no misuse had been confirmed as of 1 November. [1]

The association wrongly assumed the data had not been entered on its own site, and delayed reporting to the prefecture and notifying users by about two months. [2]