--- title: "EDION ecommerce log and payment compromise" description: "EDION’s investigation found exposed ecommerce logs and PC payment-entry tampering, prompting a service shutdown and revised data findings." incident_type: "Cybersecurity incident" status: "active" last_modified: "2026-11-11" canonical_url: "https://www.ally.security/incidents/edion-ecommerce-log-and-payment-compromise-2026" markdown_url: "https://www.ally.security/incidents/edion-ecommerce-log-and-payment-compromise-2026.md" stix_url: "https://www.ally.security/incidents/edion-ecommerce-log-and-payment-compromise-2026/stix.json" --- # EDION ecommerce log and payment compromise EDION’s investigation found exposed ecommerce logs and PC payment-entry tampering, prompting a service shutdown and revised data findings. Last modified Nov 11, 2026 · 2 sources ## Summary - **Environment:** Ecommerce logs and PC payment-entry processing - **Operational impact:** EC site stopped; limited app functions restored - **Financial impact:** No confirmed incident cost quantified ## What happened [EDION](https://www.edion.co.jp/) confirmed vulnerability-driven access to ecommerce logs November 5, 2026. A later investigation also found malicious code in PC payment processing. Its [corrected second report](https://www.edion.co.jp/system/files/news-release/pdf/ja/2026-11/20261109_pr_1_1.pdf) dates the shutdown to November 7 at 22:00 JST. [1](#source-1) [2](#source-2) ## Impact - Initial log findings covered overlapping customer groups totalling **fewer than 13,685 people**, plus unlinked entries of unresolved volume. [2](#source-2) - Revised findings included up to five card-data error logs, 5,360 gift cards and credentials for up to 1,141 customers. These categories cannot be added together. [1](#source-1) - PC payment tampering potentially exposed up to 556 new-card entry events. Smartphone payment entry was outside that program’s scope. [1](#source-1) ## Timeline ### November 4, 2026 — Payment tampering active Malicious code was active shortly after 19:00 JST. [1](#source-1) ### November 5, 2026 — Log access confirmed EDION identified access to the log-server area. [2](#source-2) ### November 7, 2026 — Services halted Shutdown began at 22:00 JST, correcting the initially reported November 8 date. [1](#source-1) ### November 8, 2026 — Limited app functions return Membership-card and coupon functions resumed at 21:10 JST. [1](#source-1) ### November 11, 2026 — Briefing updated This briefing was last reviewed and updated on November 11, 2026. ## Threat Group & Attack Vector A system vulnerability enabled log access. The payment-code insertion method remains unspecified. [1](#source-1) [2](#source-2) ### Actors - No threat actor group has been identified in the reviewed public evidence. ### TTPs - [T1190 — Exploit Public-Facing Application](https://attack.mitre.org/techniques/T1190/): exploitation reached the ecommerce log-server area. [2](#source-2) ## Response EDION requested card monitoring and password changes. The EC site remained stopped without a restart date. Its initial exclusion of card numbers and passwords was superseded by the later findings. [1](#source-1) [2](#source-2) ## Assets [Download the case-scoped STIX 2.1 bundle]() ## Sources Primary source records used to research this incident. ### EDION ecommerce unauthorized access: corrected second report official · EDION · Nov 9, 2026 ### EDION ecommerce unauthorized access: first report official · EDION · Nov 6, 2026
Evidence ledger Review the supporting structured claims. 1. **Occurred At · 100% confidence · current** PC payment tampering active: 2026-11-04 2. **Resulted In · 100% confidence · current** EDION ecommerce log and payment compromise: Shutdown date corrected 3. **Used Attack Technique · 100% confidence · current** EDION ecommerce log and payment compromise: https://attack.mitre.org/techniques/T1190/ 4. **Resulted In · 100% confidence · current** EDION ecommerce log and payment compromise: Limited app functions resume at 21:10 JST 5. **Resulted In · 100% confidence · current** EDION ecommerce log and payment compromise: The corrected shutdown time is November 7 at 22:00, replacing the originally printed November 8 date. The ecommerce site remained stopped without a restart date; selected app membership-card and coupon functions returned November 8 at 21:10. 6. **Occurred At · 100% confidence · current** EC and app services halted at 22:00 JST: 2026-11-07 7. **Occurred At · 100% confidence · current** Log-server intrusion confirmed: 2026-11-05 8. **Disclosed At · 100% confidence · current** EDION ecommerce log and payment compromise: 2026-11-06 9. **Resulted In · 100% confidence · current** EDION ecommerce log and payment compromise: PC payment tampering active 10. **Discovered At · 100% confidence · current** EDION ecommerce log and payment compromise: 2026-11-05 11. **Resulted In · 100% confidence · current** EDION ecommerce log and payment compromise: The later analysis found up to five order-error logs with card numbers, expiry dates, cardholder names and security codes; 5,360 gift cards with numbers, PINs and usage histories; and credentials for up to 1,141 customers. These overlapping categories are not a deduplicated total. 12. **Resulted In · 100% confidence · current** EDION ecommerce log and payment compromise: EDION confirmed unauthorized access November 5 around 18:30. A system vulnerability was exploited to reach a server area storing ecommerce logs; access to the main customer database had not been confirmed. 13. **Resulted In · 100% confidence · current** EDION ecommerce log and payment compromise: A separate finding in the same investigation identified malicious code in PC payment-entry processing, active from shortly after 19:00 November 4. Up to 556 new-card entry events could have sent card details directly to a third party; smartphone payment entry was outside that program’s scope. 14. **Resulted In · 100% confidence · current** EDION ecommerce log and payment compromise: The initial log review identified groups of up to 4,131 and 9,554 customers, with overlap: the actual combined number was below 13,685. Fields included identity, contact and order details; other unlinked log entries had an unresolved count. 15. **Occurred At · 100% confidence · current** Shutdown date corrected: 2026-11-10 16. **Resulted In · 100% confidence · current** EDION ecommerce log and payment compromise: Log-server intrusion confirmed 17. **Resulted In · 100% confidence · current** EDION ecommerce log and payment compromise: EC and app services halted at 22:00 JST 18. **Affected Organization · 100% confidence · current** EDION ecommerce log and payment compromise: EDION 19. **Occurred At · 100% confidence · current** Limited app functions resume at 21:10 JST: 2026-11-08 20. **Resulted In · 100% confidence · current** EDION ecommerce log and payment compromise: EDION asked card companies to strengthen monitoring, began password-change notices for affected customers and prepared additional privacy-regulator and police reporting.