Cyber Incident Victim: Micard Co., Ltd
Date:
Aug 2020
Location:
Japan
Summary
A cybersecurity breach impacted Micard Co., Ltd and its affiliate, compromising approximately 19,000 customers through unauthorized access to both the affiliate's online store and the company's homepage. Exposed data included names, addresses, phone numbers, email addresses, and dates of birth from the online store platform, while the homepage intrusion accessed member names, anticipated billing amounts, and current loyalty points. The incident stemmed from unauthorized system access affecting dual customer-facing portals operated by the entities.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
On August 5, 2020, Isetan Mitsukoshi Co., Ltd and MI Card Co., Ltd jointly disclosed a data breach impacting approximately 19,000 customers. The incident stemmed from unauthorized access to two digital platforms: the Isetan Mitsukoshi Online Store and MI Card’s official homepage. While the exact intrusion timeline was not detailed in public statements, the companies confirmed the breach resulted in the exposure of customer information across both systems. The announcement did not specify the duration of unauthorized access or the methods used by the threat actor to compromise the platforms.
The compromised data varied between the affected systems. For customers of the Mitsukoshi online store, accessed information included names, addresses, phone numbers, email addresses, and dates of birth. On MI Card’s homepage, the breach exposed member names, expected billing amounts, and current membership points held by individuals. Neither company disclosed whether financial account details, passwords, or payment card data were involved. The announcement provided no information regarding how the breach was detected, containment measures implemented, or whether law enforcement was notified. No customer-facing consequences beyond the data exposure—such as fraudulent transactions or identity theft incidents—were cited in the disclosure.