Incident BriefingsEDION ecommerce log and payment compromise

EDION ecommerce log and payment compromise

EDION’s investigation found exposed ecommerce logs and PC payment-entry tampering, prompting a service shutdown and revised data findings.

Last modified

Summary

  • Environment: Ecommerce logs and PC payment-entry processing
  • Operational impact: EC site stopped; limited app functions restored
  • Financial impact: No confirmed incident cost quantified
  • Record status: Developing record. Reviewed November 11, 2026; updated as evidence emerges.

What happened

EDION confirmed vulnerability-driven access to ecommerce logs November 5, 2026. A later investigation also found malicious code in PC payment processing. Its corrected second report dates the shutdown to November 7 at 22:00 JST. [1][2]

Impact

  • Initial log findings covered overlapping customer groups totalling fewer than 13,685 people, plus unlinked entries of unresolved volume. [2]
  • Revised findings included up to five card-data error logs, 5,360 gift cards and credentials for up to 1,141 customers. These categories cannot be added together. [1]
  • PC payment tampering potentially exposed up to 556 new-card entry events. Smartphone payment entry was outside that program’s scope. [1]

Timeline

  1. Payment tampering active

    Malicious code was active shortly after 19:00 JST.

    [1]

  2. Log access confirmed

    EDION identified access to the log-server area.

    [2]

  3. Services halted

    Shutdown began at 22:00 JST, correcting the initially reported November 8 date.

    [1]

  4. Limited app functions return

    Membership-card and coupon functions resumed at 21:10 JST.

    [1]

  5. Briefing updated

    This briefing was last reviewed and updated on November 11, 2026.

Threat Group & Attack Vector

A system vulnerability enabled log access. The payment-code insertion method remains unspecified. [1][2]

Actors

  • No threat actor group has been identified in the reviewed public evidence.

TTPs

Response

EDION requested card monitoring and password changes. The EC site remained stopped without a restart date. Its initial exclusion of card numbers and passwords was superseded by the later findings. [1][2]