Timeline of events and response
What was discovered and what we did, in chronological order. Any correction to published information is recorded in the correction history below.
- Occurred
Unauthorized access to WASABI SWITCH by a third party (first incident)
Date of occurrence identified by the subsequent investigation.
- Discovered
Stores report that customers are receiving suspicious emails
The emails contained real order information and, pretending to offer a refund, asked recipients to contact a LINE account.
- Published
Published "Warning about suspicious emails"
- Occurred
Unauthorized logins to some stores' admin screens and installation of a malicious program (found in the third report)
Leaked administrator passwords were used. This is a different route from the October 14 incident.
- Occurred
A second unauthorized access with a different cause is detected
The entry route has been identified and countermeasures are under way.
- Published
Published the first report on the data leak
We announced that information had been leaked as a result of the access on October 14.
- Action
Added security improvements (encrypted storage of credentials) to the first report
- Published
Published the second report on temporary account deactivation
Some accounts that should have been inactive were found to be active.
- Action
futureshop revokes API keys; integration suspended
- Action
All WASABI SWITCH accounts temporarily deactivated
- Published
Published notice on the futureshop integration suspension
- Action
Luxclusif integration suspended
All integrations are suspended. A resumption date has not yet been determined.
- Action
SpeedPAK integration suspended
Suspended at around 1:00 a.m. Expected to resume around Monday, October 19.
- Published
Published notice on the suspension of the SpeedPAK and Luxclusif integrations
- Occurred
Unauthorized logins to multiple stores' admin screens; order data and email account information extracted (until around 3:07 p.m.)
Part of the order data from October 17 and the email account information registered under "Mail > Account management" were extracted, and suspicious emails are being sent from stores' official email addresses.
- Published
Published the third report requesting email account password changes
We urgently asked stores to change the SMTP authentication password under "Mail > Account management". Encryption of registered information is being brought forward (planned for Sunday, October 18).
- Published
Reported to the Personal Information Protection Commission (preliminary report)
Under the Act on the Protection of Personal Information, we submitted a preliminary report to the Personal Information Protection Commission. We will submit a final report once the scope of the leak has been confirmed by the external investigation.
- Published
Published the fourth report on the temporary deletion of transaction data and stronger security measures
We announced that, as a measure until safety is confirmed, order, purchase and customer transaction information will be deleted during October 18 (all saved beforehand and to be returned to stores), that encryption of registered information is planned to be completed during October 18, and that multi-factor authentication will be introduced for STOCK SWITCH and POS Register SWITCH.
- Action
Changed content templates so that PHP can no longer be used
The investigation found that the PHP functionality in the template engine had been abused in this unauthorized access.
- Published
Published the fifth report on the forced password change, two-step verification and the content template change
Because unauthorized login attempts were found, we announced that the passwords of all accounts would be forcibly changed and two-step verification by email would be set up (carried out on October 18, 20:30–23:30).
Correction history
There are no corrections at this time.