Apology and Notice Regarding the Leak of Credit Card Information Due to Unauthorized Access to Our Website

March 29, 2021

Dear Customers,

Design X Co., Ltd.

Haruhiko Yamamoto, Representative Director

Apology and Notice Regarding Personal Information Leakage Due to Unauthorized Access to Our Company-Operated "ApparelX"

We have discovered that our B2B e-commerce site "ApparelX," operated by our company, was subject to unauthorized access by a third party, and that customer credit card information (195 cases) may have been leaked.

We sincerely apologize for causing significant inconvenience and concern to our customers and all other concerned parties.

We are currently contacting the customers whose personal information may have been leaked individually by email with an apology and notice, starting today.

We take this matter very seriously and have been implementing measures to prevent a recurrence.

We would like to once again apologize to our customers and all other concerned parties, and provide an outline of this matter as follows.

Details

1. Background

On December 9, 2020, our IT team detected that files on the payment page had been tampered with, and on the same day removed an attack file placed on the server by exploiting a vulnerability in the file upload function of our service. The file in question disguised the credit card entry form on the payment page and transferred the credit card information entered at the time of payment (card number, expiration date, security code) to an external website in order to steal it. On December 10, 2020, we filed a report with the local police station, and on December 16, 2020, under the guidance of the payment processing company, we suspended card payments. In parallel, we also began an investigation by a third-party investigative organization. On March 8, 2021, the investigation by the investigative organization was completed, and we confirmed that customer credit card information purchased on "ApparelX" during the period from November 27, 2020 to December 9, 2020 had been leaked, and that some customers' credit card information may have been used fraudulently.

As these facts have been confirmed, we are making this announcement today.

2. Status of Personal Information Leakage

(1) Cause

Because a third party made unauthorized access by exploiting a vulnerability in the file upload program of "ApparelX," operated by our company, and tampered with the payment page.

(2) Customers whose personal information may have been leaked

There are 195 customers who made credit card payments on "ApparelX" during the period from November 27, 2020 to December 9, 2020, and the information that may have been leaked is as follows.

　　・Credit card number

　　・Expiration date

　　・Security code

　　* In addition to the above credit card information, the shipping recipient name, shipping recipient email address, shipping recipient address, and shipping recipient telephone number for the relevant orders may also have been leaked.

We will contact the 195 customers concerned separately by email.

3. Request to Customers

We have already been working with credit card companies to continue monitoring transactions made with credit cards that may have been leaked, and are striving to prevent fraudulent use. We sincerely ask customers to once again check their credit card statements to see whether there are any charges they do not recognize. If you find any unrecognized charges, please contact the card company listed on the back of the same credit card. We apologize for the inconvenience and ask for your cooperation.

If you wish to replace your credit card, we have asked the credit card company to waive the card reissue fee so that this will not be a burden to you.

4. Regarding the delay in public disclosure

We deeply apologize for the time it took from the leakage concern on December 9, 2020 to this announcement.

Ordinarily, we should have contacted customers at the stage when the suspicion arose, alerted them, and apologized, but after consulting with the payment processing company, we were told that releasing unconfirmed information would only cause confusion, and that it was essential to make the announcement only after preparing measures to minimize inconvenience to customers. Therefore, we decided to wait for the results of the investigation by the investigative company and coordination with the card companies before making the announcement.

We once again apologize for the time it took to make this announcement.

5. Measures to Prevent Recurrence and Resumption of Credit Card Acceptance on the Site Operated by Our Company

We take this matter very seriously and, based on the investigation results, have strengthened our system security measures and monitoring structure. The reopening date for credit card payments on "ApparelX" will be announced again on our website once it has been decided.

We have already reported this unauthorized access to the Personal Information Protection Commission, the supervisory authority, on March 16, 2021, and reported the damage to the local police station on December 10, 2020. We will fully cooperate with the investigation going forward.

6. Contact Information Regarding This Matter

≪Design X Co., Ltd. Customer Support Desk≫

　・Reception hours: 9:00–18:00 (excluding Saturdays, Sundays, and public holidays)

　・Phone number: Toll-free 0120-978882 

　・Email address: contact@designx.co.jp 

End