Apology and Notice Regarding Leakage of Credit Card Information Due to Unauthorized Access to Our Site

March 29, 2021

Dear customers

Design X Co., Ltd.

Representative Director Haruhiko Yamamoto

Apology and notice regarding personal information leakage due to unauthorized access to "ApparelX" operated by our company

It has recently come to light that the corporate e-commerce site "ApparelX" operated by our company may have been accessed illegally by a third party, resulting in the leakage of customer credit card information (195 items).

We sincerely apologize for the great inconvenience and concern this has caused to our customers and everyone involved.

Starting today, we will be individually contacting customers whose personal information may have been leaked by email to apologize and notify them.

Our company takes this situation seriously and has taken measures to prevent it from happening again.

We would like to once again apologize to our customers and everyone involved, and would like to provide a summary of this matter as follows.

Record

1. Background

On December 9, 2020, our IT team detected that a file had been tampered with on the payment page, and on the same day, we deleted the attack file that was placed on the server due to a vulnerability in the file upload function of our service. did. By spoofing the credit card input form on the payment page, the file transferred the credit card information (card number, expiration date, security cord) entered at the time of payment to an external site and stole it. On December 10, 2020, we filed a report with the local police station, and based on the guidance of our payment agency, we suspended card payments on December 16, 2020. At the same time, we have begun an investigation by a third-party investigation organization. On March 8, 2021, an investigation by an investigative agency was completed, and the credit card information of customers who purchased from "ApparelX" between November 27, 2020 and December 9, 2020 was leaked, and some customers We have confirmed that your credit card information may have been fraudulently used.

Having confirmed the above facts, we have come to today's announcement.

2. Personal information leakage situation

(1)Cause

The payment page was falsified due to unauthorized access by a third party due to a vulnerability in the file upload program of "ApparelX" operated by our company.

(2)Customers who may have personal information leaked

The following information may have been leaked for 195 customers who made credit card payments on ApparelX between November 27, 2020 and December 9, 2020.

·Credit Card Number

·date of expiry

·security cord

*In addition to the above credit card information, there is a possibility that the shipping name, shipping email address, shipping address, and shipping phone number for the order were also leaked.

The 195 customers who fall under the above category will be contacted individually via email.

3. Request to customers

We are already working with credit card companies to continue monitoring transactions using credit cards that may have been compromised, and are working to prevent unauthorized use. We apologize for any inconvenience this may cause you, but please double check your credit card statement to make sure there are no charges that you do not recognize. In the unlikely event that you see a billing item that you do not recognize, we apologize for the inconvenience, but please contact the credit card company listed on the back of the credit card.

Furthermore, if a customer wishes to replace their credit card, we will ask the credit card company to do so so that the customer does not have to pay any fees for reissuing the card.

4. Background to the delay in publication

We sincerely apologize for the time it has taken from the leak concerns on December 9, 2020 to this announcement.

Normally, we would have contacted the customer to warn them and apologize if there was any suspicion, but after consulting with the payment processing company, we decided that disclosing uncertain information would unnecessarily cause confusion and would have caused confusion for the customer. We received an explanation that it is essential to make an announcement after making preparations to minimize the inconvenience, so we have decided to wait for the results of a research company's investigation and cooperation with credit card companies before making an announcement.

We apologize once again for taking so long to make this announcement.

5. Measures to prevent recurrence and resumption of credit card acceptance on the site operated by our company

We take this situation seriously and have strengthened our system security measures and monitoring system based on the investigation results. We will inform you on the website as soon as the date when ApparelX will resume accepting credit card payments will be announced.

In addition, our company has already reported this unauthorized access to the Personal Information Protection Commission, a supervisory authority, on March 16, 2021, and also reported the damage to the local police station on December 10, 2020. We will continue to fully cooperate with the investigation.

6. Contact point for inquiries regarding this matter

≪Design X Co., Ltd. Customer Consultation Desk≫

・Reception hours: 9:00-18:00 (excluding Saturdays, Sundays, and holidays)

・Telephone number: Toll-free 0120-978882

・Email address: contact@designx.co.jp

that's all