ENKR

E-Store ShopServe online-shop platform breach

Add to my breach check

Made public · about 23.36 million people

What leaked10

Replaceable

  • Password
  • Card expiry date

Hard to replace

  • Mobile number
  • Home or delivery address
  • Partial card number
  • Email address
  • Employer
  • Other profile data
  • Username

Permanent

  • Full name
  • Passwordmember passwords, encrypted · E-Store judges they are unlikely to be worked out; also ShopServe admin passwords of shops and passwords of affiliate-programme members, storage not stated
  • Card expiry datesame about 2,096,900 people
  • Mobile numberphone number (type not stated) and fax number
  • Home or delivery addressbuyer and delivery addresses
  • Partial card numberfirst 6 and last 4 digits and cardholder name, about 2,096,900 people; full card numbers and security codes were not held
  • Employerworkplace
  • Full namebuyers and delivery recipients
  • Other profile dataanything else the customer entered freely; for shops, the sales manager's name and the shop's name, address and phone and fax numbers printed on convenience-store payment slips
  • Usernamemember IDs · including newsletter members; ShopServe admin login IDs of shops

To-dos6 · about 1 h 30 min in all

  1. Change the leaked password everywhere you reused itabout 30 minfreeStops: account takeover
  2. Know the scam pattern: calls and texts that cite these leaked detailsabout 5 minfreeLimits harm from: scam calls, phishing messages
  3. Turn on instant transaction alertsabout 5 minHelps you notice: scam calls
  4. Turn on two-step sign-in for email and bankingabout 15 minfreeLimits harm from: account takeover
  5. Use an authenticator app or passkey instead of SMS codesabout 20 minfreeLimits harm from: account takeover
  6. Remove your address and phone from public profiles and tighten SNS privacyabout 20 minfreeLimits harm from: visits or contact at home

What happened next13 events

  1. Undetected 2 events72 days · show events
  2. Response 11 eventsNotice in 76 days · show events
  3. RemedyNone on record
  4. PenaltyNone on record
  5. DisputesNone on record
  1. No secondary harm reported as of the final report; the investigators found no posting of the data on the dark web
  2. By 16 October, fixed the exploited flaw, reset credentials, ran vulnerability assessments and added two-factor or two-step login to admin screens
  3. By 16 October, consulted the local police station
  4. By 16 October, filed reports with the Personal Information Protection Commission and the Kanto Bureau of Telecommunications
  5. By 16 October, finished contacting affected customers, shops and affiliates one by one; people it could not reach are covered by the notice and the contact desk
8 more
  1. Final report after a forensic investigation: about 23,356,000 people at 7,858 shops, about 2,096,900 of them with partial card data; an application flaw on its server was exploited
  2. Second report: access since 21 May; partial card numbers, cardholder names and expiry dates, member IDs and passwords, and shop data also leaked
  3. Opened a customer contact desk for personal data questions
  4. Apologised in its first report
  5. First report: buyer data leaked from a ShopServe server, up to 8,853,839 records with duplicates possible
  6. Cut off traffic from the attacker; no attack succeeded after that
  7. Became aware of the unauthorised access and cut off traffic from the attacker the same day
  8. Intrusion began
Company
E-Store
When it happened
–
Company detected it
Made public
Notice
Leak confirmed
Affected
about 23.36 million people: buyers and members of 7,858 current and former ShopServe shops, plus shop operators and affiliates, de-duplicated as far as possible; about 2,096,900 of them with partial card data · final report

How the facts developed

  1. Final report: about 23,356,000 people, about 2,096,900 of them with partial card data, at 7,858 shops; shop mail and FTP logins and the shops' payout bank accounts were removed from the leaked items
  2. Second report: the access began on 21 May; partial card numbers (first 6 and last 4 digits), cardholder names and expiry dates, member IDs and passwords, and shop data, including shops' payout bank accounts, were added
  3. First report: buyer data was sent out from a ShopServe server on 1 August, up to 8,853,839 records with duplicates possible; whether card data was included was still under investigation

Sources