7-Eleven's 7NOW: 160,000+ Customer Records Exposed in Breach

What was taken

Pickgo lets companies pick registered drivers who meet certain conditions and request deliveries. It is used by many firms, including major ones such as Seven-Eleven and Demae-can.

In the 7NOW case, 164,180 recipient names (in katakana) were exposed. Of those, 4,762 records combined the name with an address, and 209 combined name, address, phone number and postal code. Some records also included the order date, store name and address, and ordered items.

Credit card data, IDs and passwords were not leaked, according to the company. 7NOW continues to operate normally.

For Demae-can, 799 recipient names, 794 addresses (down to street number) and 33 phone number and postal code sets were taken. Some store names, store addresses and phone numbers, order notes, item names and fee breakdowns were also obtained.

Timeline and response

CBcloud found the intrusion on November 1. It became clear on November 3 that 7NOW user data was affected, and Seven-Eleven was notified. Neither Seven-Eleven nor Demae-can has found evidence that its authentication credentials or integration settings were leaked or altered.

CBcloud blocked traffic from the source of the attack, suspended the accounts that were misused and fixed the flaw that was exploited. It has also restricted some functions and access from outside Japan. Demae-can suspended its link with CBcloud at about 2 p.m. on November 2 and resumed it around 9 p.m. the same day after the fix and a check of communications.

The incident shows how a single contractor's platform can expose several large brands at once, a risk for anyone whose delivery data passes through shared logistics services.