Japanese software firm says 22.52 million customer records may have leaked
In short
Japanese software company Sosunekusuto (ソースネクスト) said unauthorized access may have exposed 22,519,960 customer records, including passwords and contact information. The company is requiring password resets and said credit-card information was not included.
Read the full story 1 min read
Japanese software company Sosunekusuto (ソースネクスト) said on October 15 that unauthorized access to its membership-management system may have exposed 22,519,960 customer records. Impress Watch and Asahi reported the precise figure. The potentially affected information includes email addresses, passwords, names, addresses and telephone numbers. The company is asking members to reset their passwords. [ 2 , 10 , 11 ]
Impress Watch reported that the company detected unauthorized access at about 09:00 on October 13 and completed containment by 13:36 that day, including blocking improper external communications. Subsequent investigation found that access had begun around 10:00 on October 9. The report said an interface used to retrieve membership information had been misused to obtain registered data. [ 2 ]
Other potentially affected fields include dates of birth, employers, job titles and service-registration details, according to Impress Watch. The outlet said the listed fields were the full range of potentially exposed information and did not mean every field had leaked for every member. Credit-card information was not stored in the affected system, it reported. Other outlets also said credit-card details were excluded. [ 2 , 4 , 5 , 9 , 13 ]
Nikkei reported that passwords had been stored in encrypted form but that a program capable of decrypting them had been hacked. The company warned of possible phishing emails, text messages, telephone calls and postal communications impersonating it or related parties, according to Impress Watch. TBS reported that reused passwords could allow unauthorized access to other services when combined with email addresses. [ 2 , 4 , 11 ]
Impress Watch reported no further unauthorized access after the response was completed. The company was working with outside specialists, conducting emergency checks of all systems and reviewing security, monitoring and information-management arrangements. It reported the incident to Japan's Personal Information Protection Commission on October 15 and planned to notify the relevant police station on October 16, the outlet said. [ 2 ]
Why it matters
The company warned that exposed information could be used for impersonation or phishing. TBS reported a risk to other services where customers reused the same password with their email address.
Key facts
- The company said 22,519,960 customer records may have been exposed. [ 2 , 10 ]
- Potentially affected fields include email addresses, passwords, names, addresses and telephone numbers. [ 2 , 4 , 5 , 8 , 9 , 10 , 11 , 13 ]
- The company said credit-card information was not included. [ 2 , 4 , 5 , 7 , 9 , 11 , 13 ]
- Unauthorized access was detected around 09:00 on October 13, the reports said. [ 2 , 5 , 7 , 9 , 10 ]
Confirmed by several sources
Still unclear
- The final scope of the exposure remains under investigation. Impress Watch said affected fields vary by registration details, and Nippon TV reported an ongoing investigation into the impact.
What local media are saying
Timeline, local time
- Unauthorized access began around this time on October 9, according to Impress Watch. [ 2 ]
- The company detected the access around this time on October 13. [ 2 , 5 , 10 ]
- Containment was completed by this time on October 13, according to Impress Watch. [ 2 ]
- NHK reported the possible exposure on October 15. [ 1 ]