Car-care maker Soft99 online shop hit via malicious file uploaded through inquiry form; data of up to ~137,000 customers may be exposed

Japanese car-care products maker Soft99 announced on Nov 10 that its official online shop was accessed by an outside third party, and personal data of up to 136,968 members and shoppers may have leaked ^[1]. The company says the attacker uploaded a program file through the inquiry form's image attachment feature, used it to place a file allowing remote commands, and read server configuration files with the site's privileges ^[1]. NHK reports the possibly leaked data includes credit card information, and the company has suspended the shop and reported to the Personal Information Protection Commission ^[2][1].

Industries mainly affected: Retail

NHK reports the possibly leaked data includes credit card information, and the company has suspended the shop and reported to the Personal Information Protection Commission ^[2][1]