E-store ShopServe data breach (up to 8.85 million records): partial card numbers and shop passwords leaked — what buyers and shop owners should do

E-store has not published a list of affected shops. You can check in three ways:

• Look for a notice email from E-store (in sample texts shared by recipients, the shop's name is not given)
• Check the official sites of online shops you have used for notices mentioning unauthorized access or E-store
• Ask E-store's buyer contact (support@estore.co.jp)

At least one affected shop said its affected buyers go back to 2008. A purchase made years ago can still be included.

The leak includes names, addresses, phone numbers and email addresses, plus the cardholder name, first 6 and last 4 card digits, and expiry date. That means a fake message can say "your card ending in 1234" and get the details right.

E-store also warns people not to enter card details or passwords when asked to for re-payment, identity checks, refunds or account checks. If you get such a message, do not use its links or phone numbers; open the shop's or card company's official site yourself (see What is phishing?).

According to the company, full card numbers and security codes were not included in the leak. Still, in case a fake message tricks someone into entering card details, check your statements this month and for the next few months.

If you see a charge you do not recognize, call the number on the back of your card. You can also ask your card company whether a replacement card is needed.

The company says member IDs and passwords were stored encrypted and judges the risk of misuse to be low. If you use the same email address and password on other services, change those. The company also recommends a different password for each service and multi-factor authentication.

Changing your member password at the shop you used is also sensible. A password manager is the practical way to keep track.

Buyer data includes workplace. If you had orders delivered to your office, messages combining your name and employer may arrive by work email or phone. Check anything about deliveries or payments through the shop's official site.

E-store asked merchants to take steps such as changing passwords, and recommends two-step verification (asking for a code or similar in addition to the password) for the admin panel. If you used the same passwords elsewhere, change those too.

With FTP IDs and passwords, a third party could be in a position to rewrite your shop's page files. Look at the list of recently changed files for files your team did not update and for scripts loaded from places you do not recognize.

If a malicious script is placed on a checkout page, card details are stolen as buyers type them. The APORITO online store card-data case explains what that looks like.

In case your shop mail password was used, check that no unknown forwarding or filtering rules have been added. If order and inquiry emails are being forwarded outside, information keeps flowing even after you change the password.

Also confirm that your registered payout bank details have not changed. Verify any request such as "please change the payout account" or "we need to confirm your account for a deposit" by a channel other than email (to protect your own domain, see SPF, DKIM and DMARC).

Most buyers do not know the name ShopServe, so E-store's notice email alone does not tell them which shop it is about. A notice on your own site that states the affected period, the leaked items (including whether card data was involved) and a contact point lets buyers judge their own situation.

Normal order processing handles one shop's data per operation. A single process or database connection reading many shops' data in a short time is unusual outside scheduled batch jobs.

A first step: from database audit logs, count "shops touched per hour" for each connection source, and alert when anything other than a known batch job goes over a limit (for example, 10 shops).

In this case, buyer data was sent out from the servers. Servers that process orders only need to reach a few destinations, such as payment processors and delivery companies.

Allow outbound traffic only to the destinations you need, and log and alert on traffic to anywhere else and on unusually large transfers. Firewalls and cloud network settings can do this.

If merchants' FTP and mail passwords and payout accounts can be read from the same place as buyer data, they leave together. Store credentials in a form that cannot be restored, and keep anything that must be restorable in a separate store with a separate key.

See storing passwords safely (hashing and salt) for storage, and the minimum security baseline for organizations for the wider picture.

Buyers only know the name of the shop they used. A single service-wide notice from the operator does not let them tell whether they are affected.

Make sure you can quickly produce, per shop, the affected period, the leaked items and whether card data was involved, and include handing that to each client business so it can explain to its own buyers in your incident-response procedure.