e-commerce
11 articles with this tag
Unauthorized access to a company that handles e-commerce logistics (warehousing and shipping) may have leaked delivery data from several online shops: names, addresses, phone numbers and more — what buyers should do
On November 11, 2026, a company that handles logistics (warehousing and shipping) for e-commerce shops announced that an outside third party had gained unauthorized access to its systems between November 8 and 9, and that part of its shipping data had been taken. The data covers shipping requests made from April 8 to November 8, 2026, and the information that may have leaked is the recipient's name, address and phone number, the email address (if registered), and item information. The company says it does not hold credit card numbers, so they are not affected. The number of people is under investigation, and as of November 11 no misuse or secondary damage had been confirmed. Online shops that outsource logistics to this company have published the effect on their own customers on their official sites (this article lists the six whose official notices we were able to read; counts are as each shop states them and no total is given). Our conclusion: buyers should assume that contact pretending to be a courier, the shop you bought from or an order can look genuine, and should not respond to payment demands or confirmations from anyone who knows their contact details and what they bought.
Fandango Checkout Page Card Data Breach (October 2026): Unauthorized Access Possible; Card Number, CVV, Expiration Date, Billing ZIP and Email May Be Impacted. What to Do
Fandango Media, the movie ticketing company, filed a notice with the California Attorney General on November 13, 2026. The notice says the company became aware of an issue with its ticketing checkout page, investigated with outside cybersecurity specialists and resolved it. It says the investigation found evidence that an unauthorized party could access payment card information associated with certain transactions on the checkout page from October 8 to 11, 2026, and that on October 30 it determined a given person's information may have been impacted. The information that may have been impacted is the payment card number, CVV, expiration date, billing ZIP code and email address. The notice says first and last name, government-issued identification information, Social Security numbers and other account information were not involved. Fandango says it is not currently aware of any fraudulent use of the information, and offers 24 months of credit monitoring, dark web monitoring, an identity theft insurance policy reimbursing recovery expenses (up to 1,000,000 dollars, subject to the policy terms) and managed identity theft recovery through a monitoring-service provider; the sample says to activate by February 13, 2027. The number of people affected is not stated, and we found no separate company announcement. Our view: if you bought tickets on Fandango's checkout page around those dates, check your card statements, tell your card issuer about charges you do not recognize, and ask the issuer whether to replace the card.
Unauthorized access to Edion's online store (order data on up to 9,554 customers and more): card details, gift card PINs and login credentials may have leaked — what users should do
On November 6, 2026, Edion Corporation announced that unauthorized access to the server hosting its online store may have leaked some customers' personal information, and on November 9 its second report corrected and added to that notice. The first report listed information recorded in log files for up to 4,131 customers (name, email address, phone number, date of birth, address, customer number and more) and order information for up to 9,554 customers (name, order number, order amount, credit card expiry date, gift card number and more), and said credit card numbers and login passwords were not included. The second report corrects this: credit card information recorded in order-time error logs (number, expiry date, cardholder name, security code) for up to 5 cases, Edion Gift Card information for 5,360 cards (number, PIN, usage history), and login IDs and passwords for up to 1,141 customers were included. It also says a malicious program had been inserted into payment-related processing by an outside third party and had been running since just after 19:00 on November 4. For card details newly entered on a PC at the payment input screen (up to 556 entries), the company cannot rule out that they leaked directly to a third party; smartphones were not affected. The company stopped the online store and related services at 22:00 on November 7, and the online store has no restart date. This site's conclusion: if you entered a new card on Edion's online store from a PC after 19:00 on November 4, check your statement and ask your card company about changing the card number.
Nitori unauthorized access: personal data of up to 37.62 million records may have leaked (names, addresses, phone numbers, birth dates) — what individual and corporate members should do
On November 9, 2026, Nitori Holdings Co., Ltd. announced that it confirmed unauthorized access by a third party to a system it manages on November 6, and that personal information held on its servers, up to 37.62 million records, may have leaked externally. The data covers individual members and purchasers at the Nitori Group (member number, name including furigana, email address, address, phone number, date of birth, gender), corporate members (member number, company name, department, representative's name, company address and phone number, and the contact person's name, email address and phone number), and order data placed through Nitori Net and the official Nitori shop on e-commerce malls. The company says login passwords and credit card information are not included. Third-party access may also have taken place from mid to late October, the route is under investigation, and the count may change. The company says it will contact affected customers by email or post in turn. As of November 10, 2026, no follow-up notice had been found. This site's conclusion: because address, phone number and name are all in the data, a call, text or email using the name of Nitori or a delivery company is not genuine just because it knows your correct address or order.
Unauthorized access to Euglena's akyrise online store (up to about 900,000 records): names, addresses and phone numbers may have leaked — what buyers should do
On November 5, 2026, Euglena Co., Ltd. announced that the online store of its cosmetics brand akyrise was accessed without authorization by a third party on November 4, and that member information leaked. The company closed the store the same day and filed a preliminary report with Japan's Personal Information Protection Commission. The information that may have leaked falls into two groups: login account information (customer ID, email address and the login password, which was stored in hashed form), up to about 490,000 records; and registration and purchase information (name, address, phone number, date of birth, gender, email address, and purchase and delivery information), up to about 900,000 records. Both counts are still being verified, and since the company does not say how they overlap, the two figures cannot be added together. Credit card numbers are not held on the company's servers and are not included. The same notice also covers separate unauthorized access at an email delivery service provider and a delivery company, which the company describes as independent events. As of November 9, 2026, no follow-up notice had been found. This site's conclusion: a message, text or call using the akyrise name is not genuine just because it knows your name or address. Do not open links, and if you reused your akyrise password elsewhere, change it there first.
Good Smile Company Official Shop Breach (Full Card Data May Have Leaked for 2,800 People, Partial Card Data on 402,466 Cards, Up to 202 Orders Possibly Viewed): What Each Group Should Do
Good Smile Company Co., Ltd. announced on October 23, 2026 that its official shop had been accessed by a third party, and by its fourth report on October 30 it had sorted those affected into three groups. Group B (2,800 people) may have had the cardholder name, card number, expiry date and security code entered on the payment page captured by a malicious program that was in place from 13:55 on October 21 to 7:00 on October 23. Group A (anyone who ever registered a card; 402,466 cards, number of people still being checked) is limited to the last four digits of the card number and the expiry date, and the company considers misuse of that alone extremely unlikely. Group C (5,356 people) concerns unshipped order data (name, address, phone number, email, order contents and similar); at most 202 orders may actually have been viewed. The company says the cause is not the recently reported PHP vulnerability. This site's conclusion: Group B should contact the card issuer and ask about changing the card number. People who get no email but ever registered a card on the shop are still in scope and should check statements. Do not open links in unexpected messages claiming to come from the company.
Revolve customer account breach: saved card numbers and expiry dates accessed (1,515,073 people per the Indiana AG list) — what customers should do
US fashion retailer Revolve disclosed in a US securities filing on October 29, 2026, as reported by The Record, that an unauthorized party used automated means to access customer account data, including names, contact details, and saved payment card numbers and expiry dates. Early state records showed only per-state counts, such as 127,200 Texans. The Indiana Attorney General's data breach list (November 2026 edition) now shows Revolve Group, Inc with notification date October 29, breach date September 11, 10,534 Indiana residents and 1,515,073 people in total. Notices to five other states (Iowa, Massachusetts, South Carolina, Texas, Vermont) had added up to only about 197,000, per SecurityWeek. Whether the card security code (CVV) was involved is not stated in the sources we read. This site's take: if you saved a card on your Revolve account, watch your statements for small unfamiliar charges, ask your card issuer whether to reissue the card, and treat any message that quotes your order history as suspect until you check it yourself.
Drupal Commerce Core CVE-2026-118539: unauthenticated access bypass, actively exploited (update to 8.x-2.41 or 3.3.13)
On October 28, 2026, the Drupal Security Team published SA-CONTRIB-2026-254 for the Commerce Core module (CVE-2026-118539). The module does not sufficiently protect certain routes and entity fields, which allows an access bypass that may have a financial impact on the shop owner. Drupal rates it Highly critical (21/25), requiring no authentication, and states that it is being actively exploited in the wild. Affected versions are below 8.x-2.41 and 3.0.0 up to but not including 3.3.13; fixed versions are 8.x-2.41 and 3.3.13. NVD's record shows a lower CVSS v3.1 score of 6.5 added by CISA's ADP and is still awaiting analysis. As of October 31 it is not in CISA's KEV catalog. Our conclusion: if you run an online shop on Drupal Commerce, update now and audit recent orders and payments for anything inconsistent.
Adobe Commerce and Magento vulnerability CVE-2026-48356: CISA confirms exploitation (KEV), the July fix, and how to check for intrusion
On October 27, 2026, CISA added CVE-2026-48356, a file upload vulnerability in Adobe Commerce and Magento Open Source, to its Known Exploited Vulnerabilities (KEV) catalog. The deadline for US federal civilian agencies is November 10. Adobe fixed this flaw, along with 13 others, in security bulletin APSB26-73 on July 14, 2026. Adobe Commerce 2.4.4 to 2.4.9, Magento Open Source 2.4.6 to 2.4.9, Adobe Commerce B2B and Adobe Commerce Events are affected. The fix is the 2026-jul security fix for each release line (1.21.0 for Events). Adobe's bulletin table rates it CVSS 9.6, while Adobe's CVE record and NVD rate it 9.3; the only difference is the availability impact. Adobe's bulletin (updated August 11) still says Adobe is not aware of exploitation. On October 24, an e-commerce security company reported that web shells placed through this flaw (which it calls PolyShell) and other flaws were used to inject JavaScript into store pages, in a campaign that has reached 953 stores, mostly Magento, since July 2025, and that it found the injected code on patched stores too. As of October 28, no Japanese public agency has issued an alert and no Japanese store has disclosed being affected. This site's conclusion: Adobe Commerce and Magento stores should confirm today that the July fix is applied, and even if it is, check upload folders, CMS blocks and admin accounts for signs of intrusion.
Card-Stealing Program on the PhotoGoods (Daiko Printing) Payment Page: What People Who Paid Between August 6 and September 11 Should Do
On September 16, 2026, Daiko Printing Co., Ltd. announced unauthorized third-party access to PhotoGoods (photo-goods.com), the service it runs, and said a program able to illegally capture credit card data entered on the payment page had been installed. The program was in place from August 6 until it was removed on September 11. People who entered a card on the payment page in that period (including those who did not complete a purchase) may have had their card number, expiry date and security code exposed, along with name, address, phone number, email address and information derived from their member password (stored in a converted form). The company says it confirmed unauthorized access through system vulnerabilities and abuse of a file-upload function. The number of affected people and the actual scope are under investigation, and there was no follow-up notice as of October 7. This site's take: anyone who entered a card in that period should ask the card issuer to change the number, change the password on any other service that shares the PhotoGoods password, and ignore links in 'apology' or 'refund' messages.
APORITO Online Store (RIZAP) Possible Card Data Leak: What Customers and Online Shops Should Do
According to RIZAP Co., Ltd., a third party planted a malicious script on its APORITO Online Store, and the names, addresses, phone numbers and email addresses — plus card numbers, expiry dates and security codes — of people who placed an order or entered information between May 1 and August 5, 2026 may have been sent outside. The company found a suspicious outbound-transmission program on August 5 and closed the store that day; as of August 18 the store remained closed and the investigation continued. It says no misuse or actual leak has been confirmed. This site's take: with the security code in scope, watching statements is not enough; ask your card issuer to replace the number. The lesson for e-commerce operators is that not storing card data ('non-retention') does not stop a malicious program from being planted in the input page. On top of the five vulnerability measures required by Japan's Credit Card Security Guidelines, have a way to detect changes to your payment page.