[ITmedia Business Online] About 23.35 million people's information leaked through EC site management support "Shopserve" Some credit card information was also leaked

On October 16, E-Store (Minato-ku, Tokyo), which handles the e-commerce site construction and operation support service ``Shopserve'', announced that the personal information of approximately 23,356,000 people, including users of its mail-order site, had been leaked. It was discovered that some of the credit card information of about 2,096,900 people was included.

Credit card information was also leaked, and the operator explained that ``payments cannot be made.''

According to the company, from May 21st to August 1st, a vulnerability in an application running on the server was exploited, allowing information in the database to be sent externally. Communications from the source of the attack were cut off on August 1st, and a subsequent investigation confirmed that there were no other routes of compromise.

The leaked information included the names, addresses, phone numbers, and email addresses of purchasers and members at 7,858 stores that use Shopserve. Additionally, the card name, expiration date, and part of the card number (first six digits and last four digits) for approximately 2,096,900 people were leaked. The company does not hold complete card numbers or security codes, and explains that ``it is not possible to make payments using only the information leaked this time.''

At this time, no specific secondary damage or leakage to the dark web due to this incident has been confirmed. The company has reported to the Personal Information Protection Commission and the Kanto Telecommunications Bureau, and has consulted the police, and has implemented measures to prevent recurrence, such as fixing vulnerabilities and introducing multi-factor authentication to the management screen.