Muji suffers gap: 1 million credit cards exposed without encryption
The retailer japanese Muji confirmed on 12 November that more than 1 million credit card numbers were exposed.
They were not encrypted.
Were not protected.
They were stored in plain text.
This is not only a data breach. It is a massive failure of compliance with PCI-DSS.
What happened
The incident
FACT (according to the Report, Asia):
Ryohin Keikaku Co. (the operator of Muji) discovered a vulnerability in its system that allowed a cyber attack.
FACT: A million+ in credit card numbers were exposed.
FACT: The numbers were not encrypted or protected properly.
Scale of the gap
1 million credit cards means:
- Potentially 1 million customers, with a risk of fraud
- Years of transaction data exposed
- Bank information, sensitive compromised
Severity of the storage
ANALYSIS: The fact that numbers of the card were unencrypted means:
- Rape total of PCI-DSS (Payment Card Industry Data Security Standard):
- PCI-DSS requires that card numbers are encrypted
- Muji was not only hacked, but that STORED data in an unsafe way
- Exposure anticipated:
- Even if there had been no attack, these data were at risk of permanent
- Any employee with access could see them
- Any internal error could expose them
- Composite damage:
- Data were not protected
- System was vulnerable and was exploited
- Double fault: unsafe storage + security systems insecure
Why it was possible to
Failure architectural critic
If card numbers were stored in plain text:
- There is No encryption of data-at-rest
- There is No separation between sensitive data and application systems
- There is No validation of that sensitive data are protected
Failure to comply
PCI-DSS is a MANDATORY standard for any company that handles credit card data.
Which Muji does not meet means:
- Security audits are ineffective or non-existent
- Lack of validation of compliance controls
- Culture of weak security
Fault detection
The fact that it was necessary to an external attack to discover, this means:
- Not had internal monitoring
- He had not validation that sensitive data are protected
- Lack of scans of regular safety
The impact
For customers of Muji
- Risk of fraud in credit cards
- Banking information in the dark web
- Possible identity theft
- Need credit monitoring for life
For Muji
- Reputational harm mass
- Potential demands of customers
- Lack of trust in data security
- Costs of remediation huge
Industry retail
It shows that even retailers large may fail at basic controls of compliance.
How to 24Cevent would have helped
If Muji had detection of anomalies in their payment systems:
Detection of unsafe storage
If you have validation of sensitive data:
- System would detect: ‘card Numbers stored in plain text’
- Alert: ‘PCI-DSS VIOLATION: Credit card data not encrypted’
- Immediate action: data Encryption + remediation
The problem would have been detected internally before an attack.
Detection of access to sensitive data
If someone was trying to access the card data:
- Monitoring: ‘Access to table numbers card’
- Correlation: ‘Access from location anomalous or unknown user’
- Action: immediate Lockout + research
The attack would have been detected before exfiltration complete.
Validation regular
24Cevent could continuously validate:
- Does the sensitive data are encrypted?
- Are there changes in policies for access to data?
- Are there users accessing data they should not?
Result: Problem found and corrected internally, not via external attack.
The lesson
Muji was not ‘hacked sophisticated’.
Muji stored data in an unsafe way, and the attack was opportunistic.
This shows that:
- Regulatory compliance is critical (PCI-DSS existed for a reason)
- The security architecture must be validated continuously
- The sensitive data can not be treated casually
For any company that handles customer data:
- PCI-DSS is not a ‘recommendation’
- It is a mandatory requirement of security
- To fail means to be exposed to attacks and lawsuits
SOURCES CHECKED: