Key takeaways

  • EDION, one of Japan's largest electronics retail chains, disclosed on November 6 that attackers had exploited a vulnerability to reach the server area holding its online store's log files, exposing up to 13,685 people's names, addresses and phone numbers.
  • Its second report found the logs held much more: card numbers with security codes recorded when orders failed, 5,360 gift card numbers with PINs, and login IDs and passwords for up to 1,141 customers.
  • Investigating that, EDION also found its PC payment page had been altered to send card details to a third party, from just after 19:00 on November 4, the day before the log access. Up to 556 card entries are affected. Smartphone payments were not.
  • The skimmer was not caught by monitoring. It came to light in the investigation of the log access, and ran until EDION shut the store down at 22:00 on November 7.
  • EDION's card payments were "non-retention": card data was not stored on its servers. That does not stop a script that steals card details as customers type them.

What happened#

According to EDION's stock exchange filing of November 10, which brings together reports first posted on its corporate site:

  • November 4, just after 19:00: a malicious program begins running in the payment input processing for PCs on EDION's online store.
  • November 5, around 18:30: attackers exploit a system vulnerability to access part of the server area where the store's log files are kept.
  • November 6: EDION publishes its first report on the log access, with up to 13,685 people's details.
  • November 7, 22:00: as investigation and monitoring turn up more, including traces of access by a new method, EDION stops its online store and official apps as a precaution.
  • November 8, 21:10: after checks, the apps' digital member card and coupon functions restart. The online store remains closed, with no restart date.
  • November 9: the second report sets out the additional data in the logs and the payment page tampering.

EDION treats the payment page tampering as a separate method from the log access. It has not said whether the same attackers or the same way in were behind both, and the causes of both are under investigation. It is preparing additional reports to the privacy regulator and the police.

What was in the logs#

The log files recorded the store's communication processing. According to EDION, they also held:

Data Count Why it was there
Names, addresses, phone numbers and other details Up to 13,685 people First report
Card number, expiry, cardholder name, security code Up to 5 When an error occurred on the order screen, what the customer had entered was recorded in the system log
EDION gift card number, PIN and usage history 5,360 cards Not explained
Login IDs and passwords Up to 1,141 customers Not explained

EDION says the gift cards can be used with only a number and PIN on its online store, which is closed, and in stores only with the physical card. New logins to the store require two-step authentication, and affected customers will be asked to change their passwords.

The payment page skimmer#

The second problem was on the payment page itself. A malicious program inserted into the PC version of the payment input process could send card details typed into it directly to a third party. Up to 556 new card entries made between November 4 and the shutdown may be affected: card number, expiry date, cardholder name and security code. Payments made from smartphones were not affected.

EDION points out that its card payments are "non-retention" (非保持化), meaning card data is not kept on its servers. That is true, and it is why the skimmer was needed: an attacker who cannot steal stored card data steals it at the moment it is typed. EDION has asked card companies to step up fraud monitoring and asks customers who paid by card on a PC since November 4 to check their statements.

Japan's electronics retailers this autumn#

EDION joins a run of incidents at Japan's electronics chains: Joshin (up to 6 million member records), Nojima (about 7 million), and Bic Camera, Kojima and Sofmap (about 14.9 million newsletter subscribers, through the Arara Message email service), all on our list of 2026's largest breaches. EDION's numbers are much smaller, but its case shows two problems the others do not.

What we don't know yet#

  • What the vulnerability was, and whether the log access and the skimmer share a way in
  • What the "server area" holding the logs is: a directory on the web server itself, or a separate storage service such as object storage, which many sites use for logs
  • How the payment page was altered, and why only the PC version
  • Why gift card PINs and passwords were in log files at all, and whether passwords were stored in readable form
  • How long the logs had been collecting this data, and whether earlier logs were exposed
  • Whether the attackers also reached the store's member database. EDION's figures so far all come from the logs and the payment page
  • When the online store will reopen

Our view#

The skimmer went unnoticed. For about three days, anyone paying by card on a PC handed their card details to a third party, and EDION did not know. It found the tampering only because it was already investigating a different intrusion. Without the log incident, the skimmer could have run much longer. Card data non-retention protects what sits on a merchant's servers, not what runs in the customer's browser. Online stores need to watch the payment page itself: keep an inventory of the scripts it loads, and detect any change to them or to the files that serve them. The card industry's PCI DSS standard now asks for exactly that.

The scope may be wider than the logs. EDION's figures so far all come from the log files and the payment page. But an attacker who could exploit the web application to reach its logs, or who could change the code of its payment page, was in a position to reach much more, including the member database the application uses. EDION has not said that the database was reached, and it has not said that it was ruled out. The first question its investigation should answer publicly is how far the attackers' access went, not only what the logs contained.

Sensitive data in logs is common, so treat logs as storage. Card numbers and security codes written to an error log, gift card PINs and passwords in communication records: none of this is unusual. Error handlers that dump the whole request and debug output left on in production put secrets into logs all the time. EDION describes the place it was attacked only as a "server area" for log files. In our reading, it is likely a storage location separate from the web application, such as object storage, of the kind many sites use to collect logs. Wherever it is, logs should be managed like any other place data is stored: decide what may be written to them, mask card numbers, codes, PINs and passwords before they are written, limit who and what can read them, and delete them on a schedule. It is the same lesson as GMO Trust Login's temporary files: data that nobody thinks of as data ends up where nobody protects it.

What this means for practitioners#

  • Monitor payment pages for script and file changes, and alert on any change that was not deployed by you.
  • Scrub logs at the source. Mask or drop card numbers, security codes, PINs, passwords and tokens before they reach any log, including error and debug logs.
  • Find out what your logs already hold. Search them for card numbers, PINs and passwords; you may be surprised.
  • Restrict and expire log storage. Logs should not sit in an area reachable from the web server's vulnerabilities, and should be deleted when no longer needed.
  • Do not rely on non-retention alone. It removes one target; attackers move to the payment page.

Japanese terms at a glance#

Japanese Reading Meaning
ログファイル rogu fairu Log file
エラーログ erā rogu Error log
改ざん kaizan Tampering, alteration
不正なプログラム fusei na puroguramu Malicious program
決済画面 kessai gamen Payment page
非保持化 hihojika Not retaining card data
セキュリティコード sekyuriti kōdo Card security code (CVV)
緊急停止 kinkyū teishi Emergency shutdown