Member data stolen from a company using I’ll’s CROSS POINT
A leaked valid API authentication key from a company using Japanese firm I’ll’s CROSS POINT membership and loyalty points management service was exploited to obtain member information without authorisation. The information included names, addresses, contact details, membership numbers and purchasing statistics, while the affected company’s name and the number of people affected were not disclosed. The operator revoked and reissued the compromised key and API keys for all client companies, and blocked the source of the attack.
Key facts
- Affected organisation
- I’ll
- Incident type
- Data breach
- Occurred / detected
- Not confirmed
- Scale of damage
- Member information from one client company; number of people affected not disclosed
- Cause / method
- Exploitation of a leaked valid API authentication key
- Location
- Japan
If your data was exposed
Exposed dataNameAddressPhone numberUsage & purchase history
- Don’t tap links in texts, calls or emails that mention this incident and offer compensation, refunds or breach checks. Check directly on the organisation’s official website or app.
Timeline
- I’ll disclosed that member information from one company using CROSS POINT had been obtained without authorisation through the exploitation of a leaked valid API key.
- The operator said it had revoked and reissued the compromised key and API keys for all client companies, and blocked the source of the attack.
4 related reports
The summary and key facts are written by AI from related reports and may contain errors. Check the original articles and the organisation’s official statements for accurate details.