Security notice
Take card payments on your site? EDION says a hidden program on its checkout page sent card details to a third party.
On November 10, 2026, EDION, one of Japan's largest electronics retailers, said in a stock exchange filing that its online store had been attacked in two ways. A malicious program was added to the card entry step of its checkout for desktop and laptop computers, so card details typed there may have gone straight to a third party: up to 556 card entries from just after 7 PM Japan time on November 4. Separately, attackers used a system weakness to reach log files that, it turned out, held some card numbers with security codes, gift card numbers with PINs, and login IDs with passwords. EDION says its card payments were set up so card data is not kept on its servers, but this attack took card details as they were typed into the page. The online store has been closed since November 7. This is not a software flaw you can patch, and there is no CVE. If you take cards on your site, check what your checkout page loads and what your logs record. (EDION filing, Nov 10)
What happened
- November 5: log files reached. EDION says that at about 6:30 PM Japan time on November 5, outsiders used a system weakness to access part of the server area holding the online store's log files, which temporarily record its activity and communications. Its first report, on November 6, said names, addresses, phone numbers and other details for up to 13,685 people in those logs may have leaked, and that it had not confirmed access to the main customer database. (EDION, Nov 6, EDION filing, Nov 10)
- November 9: more in the logs. EDION corrected its first report. The logs also held card number, expiry date, name on card and security code for up to 5 orders, because when an error happened on the order screen, what the customer typed was recorded in a system log. They also held 5,360 EDION gift card numbers with PINs and usage history, and login IDs with passwords for up to 1,141 customers. (EDION filing, Nov 10, EDION, Nov 9)
- November 9: checkout page altered. EDION says a third party had built a malicious program into the card entry step of its checkout for computers, running since just after 7 PM Japan time on November 4. Card number, expiry date, name on card and security code entered there may have gone directly to a third party, for up to 556 new card entries. EDION says payments made from smartphones were not affected. (EDION filing, Nov 10)
- Card data not stored did not stop it. EDION says its card payments were set up so that card data is not kept on its servers. It says this attack worked differently: the malicious program was inside the card entry step itself. (EDION filing, Nov 10)
- Store closed. After finding traces of access by a new method, EDION shut down its online store and apps at 10 PM Japan time on November 7. App member card and coupon features restarted on November 8. The online store remains closed with no restart date. (EDION filing, Nov 10)
- What EDION is doing. It has asked card companies to step up fraud monitoring, is emailing the 1,141 customers to change passwords, says new logins to its store need two-step authentication, and is preparing further reports to Japan's privacy regulator and the police. It has not said what the weakness was, how the checkout page was altered, or whether the two problems are linked. (EDION filing, Nov 10)
Who should worry
- You paid by card on EDION's online store from a computer on or after November 4, 2026, or you got an email from EDION asking you to change your password.
- You run an online store where customers type card details into a page on your own site, even if a payment provider handles and stores the card data.
- Your store or its plugins write order errors, form data or debugging output to log files.
If you never shopped at EDION online and your site takes no payments, this notice does not apply to you.
What to do now
If you paid EDION by card from a computer since November 4. This follows EDION's advice.
- Check your card statements for charges you do not recognize, and call the number on the back of your card about anything suspicious. (EDION filing, Nov 10)
- Change your password if EDION emails you. (EDION filing, Nov 10)
- Watch for fake emails, texts and calls that claim to come from EDION. (EDION filing, Nov 10)
If you run an online store. These are general steps, not from EDION, except where we cite it. We are not claiming any tool, including EverThread, would have prevented or caught this.
- Know what your checkout page loads. Ask your developer for a list of every script on the pages where customers type card details, who added each one, and how you would find out if one changed or a new one appeared. A payment provider keeping card data off your server does not protect a page that has been altered. (EDION filing, Nov 10)
- Where you can, let the payment provider host the card fields. Ask your provider whether card details are typed into its own hosted fields or page rather than into your page's code.
- Do not log what customers type. EDION's logs captured card numbers and security codes when an order failed. Ask your developer to make sure error logs, debug output and form plugins never record card numbers, security codes, gift card PINs or passwords. (EDION filing, Nov 10)
- Treat log files as customer data. Find out where your logs are kept, who and what can read them, and how long they are kept. Delete what you do not need.
- Know who to call. Keep your payment provider's and developer's contact details handy, so you can act fast if you ever suspect card data was taken.
What to send your developer, agency or host
EDION said on November 10, 2026 that a malicious program was built into the card entry step of its online store checkout, sending card details typed on computers to a third party, and that attackers also read log files that held card numbers, security codes, gift card PINs and passwords recorded when orders failed. Please list every script that loads on our checkout and card entry pages, tell us who added each one and how we would know if one changed or a new one appeared, and confirm whether card details are typed into our payment provider's hosted fields or into our own page. Please also check that our error logs, debug logs and form plugins never record card numbers, security codes, PINs or passwords, tell us where logs are kept, who can read them and how long they are kept, and delete any that hold this kind of data. Source: EDION's stock exchange filing of November 10, 2026.
Common questions
Has my site been hacked?
This notice does not mean your site has been hacked. It is about a breach at EDION. It matters to store owners because the same kind of checkout page tampering can hit any store where customers type card details into its pages.
Can EverThread tell me if I am affected?
No. EverThread does not test for this. We check your home page from the outside, the way a browser sees it. We do not check your checkout or payment pages, and we cannot see your server logs or how your payments are set up. A scan without a warning does not mean your checkout page is safe.
My payment provider stores the cards. Am I covered?
Not fully. EDION says its card payments were set up so card data stayed off its servers, and card details were still taken as they were typed into its checkout page. Ask your developer and payment provider how your checkout page is protected. (EDION filing, Nov 10)
Is there anything to update?
EDION has not named any software or flaw, so there is no specific update to install. Keep your store software, plugins and themes up to date anyway.
Where can I follow official updates?
EDION's corporate site (in Japanese). All current notices are on our notices page.
Security alerts by email
Hear about the next one first.
When a flaw puts websites at risk, we send one email: what happened, who it affects and what to do. It's free, whether or not you use EverThread.
Sources
- EDION: Personal information leak and service suspension following unauthorized access to our online store, stock exchange filing, November 10, 2026 (PDF), in Japanese, checked November 11, 2026
- EDION: Newly found events, possible personal information leak and service suspension (second report), November 9, 2026, corrected November 10, 2026 (PDF), in Japanese, checked November 11, 2026
- EDION: Possible personal information leak due to unauthorized access to our online store, November 6, 2026 (PDF), in Japanese, checked November 11, 2026