Seven-Eleven Japan said on November 3 that information on more than 164,000 users of its 7NOW delivery service was obtained by an outside party. The breach came through unauthorized access to PickGo, a delivery platform operated by CBcloud, which handles some of 7NOW's delivery work.
Demae-can said the same day that about 800 pieces of customer information had leaked in the same intrusion. PickGo lets registered drivers be matched to delivery jobs, and is used by many companies, including major ones such as Seven-Eleven and Demae-can.
What was exposed at 7NOW
The 7NOW data includes the names in katakana of 164,180 order recipients, 4,762 combinations of name and address, and 209 combinations of name, address, phone number and postal code. For some orders, the order date, the name and address of the store that took the order, and the names of the products ordered were also obtained.
Credit card information, IDs and passwords were not leaked. 7NOW is operating as normal.
CBcloud's investigation found the unauthorized access on November 1. On November 3 it confirmed that 7NOW user information had also been taken and contacted Seven-Eleven. Seven-Eleven said it has found no sign that its own credentials or integration settings were leaked or rewritten.
CBcloud blocks access and fixes flaw
After confirming the intrusion, CBcloud cut off communications from the source, suspended the account that had been misused, and fixed the flaw that was exploited. As part of its response it has restricted some functions and access from outside Japan.
Demae-can said the data taken included the names of 799 order recipients, the addresses of 794 recipients down to the block number, and the phone numbers and postal codes of 33 recipients. Some store names, store addresses and phone numbers, order notes, product names and price breakdowns were also obtained.
Demae-can suspended its integration with CBcloud shortly after 2 p.m. on November 2 and restored it around 9 p.m. the same day, after the flaw was fixed and communications were checked. It said it has found no sign that its own credentials or integration settings were leaked or rewritten.