Lawson says unauthorised access leaked personal data tied to about 2.155 million IDs
In short
Lawson announced on October 8 that a third party had gained unauthorised access to its "Lawson ID" account service and that personal information tied to about 2.155 million IDs had leaked, including email addresses, names, phone numbers and addresses. The access took place in mid-September, on September 12 to 14 according to Tokyo Shimbun, and Lawson said no misuse had been confirmed so far. On the same day, karaoke operator Daiichikosho (第一興商) said about 8.72 million customer records may have leaked.
Read the full story 2 min read
Lawson announced on October 8 that its account service "Lawson ID" had been accessed without authorisation by a third party and that users' personal information had leaked. About 2.155 million IDs were affected, Sankei Shimbun and Tokyo Shimbun reported. TBS NEWS DIG gave the figure as 2,155,345, which it said was about 10% of Lawson ID members, and reported that the system concerned was related to the Lawson app. Lawson said no misuse of the information had been confirmed so far. [ 1 , 3 , 6 , 8 , 10 ]
The leaked information includes email addresses, names, gender, phone numbers and addresses, according to Sankei and Tokyo Shimbun. Asahi Shimbun reported that email addresses and names were leaked for the Lawson ID accounts, along with the phone numbers and addresses of people who had used services such as prize applications. Asahi also reported that for 26 uses of "Lawson App Reservation", which is used in the app to reserve items such as osechi, names, phone numbers and part of the credit card numbers were leaked. [ 3 , 4 , 8 ]
The outlets differed slightly on how the breach came to light. Asahi said Lawson's regular investigations found that the services had been accessed in mid-September. Tokyo Shimbun said an investigation carried out on October 7 found that the access took place on September 12 to 14. TBS NEWS DIG said the access in mid-September was not detected by security system monitoring and was found on October 7. [ 4 , 6 , 8 ]
Lawson has blocked the sources of the unauthorised access and urged affected users to watch for suspicious emails and phone calls, Asahi reported. The company said in a statement that it deeply apologised for the great concern and trouble caused. [ 3 , 4 , 6 , 8 ]
On the same day, karaoke operator Daiichikosho (第一興商) announced that about 8.72 million customer records may have leaked. According to Sankei, a device used by an employee of a contractor was infected with malware, and customers' names, dates of birth and email addresses may have leaked. Passwords were not included and no misuse of points had been confirmed, the company said. Sankei and Tokyo Shimbun reported that further cyberattack damage at companies came to light on October 8, and TBS NEWS DIG said unauthorised access targeting companies has been continuing. [ 3 , 6 , 8 , 10 ]
Why it matters
The leak covers about 10% of Lawson ID members, according to TBS NEWS DIG, and some app users' partial credit card numbers were also exposed. Several outlets placed the case among a string of cyberattacks on companies that came to light on the same day.
Key facts
- Lawson announced on October 8 that its "Lawson ID" account service had been accessed without authorisation by a third party and users' personal information had leaked. [ 3 , 4 , 6 , 8 , 10 ]
- About 2.155 million Lawson IDs were affected; TBS NEWS DIG gave the figure as 2,155,345, about 10% of Lawson ID members. [ 1 , 3 , 6 , 8 , 10 ]
- The leaked data includes email addresses, names, gender, phone numbers and addresses. [ 3 , 8 , 10 ]
- Names, phone numbers and part of the credit card numbers were leaked for 26 uses of the "Lawson App Reservation" service. [ 4 ]
- The unauthorised access took place in mid-September and was found on October 7. [ 6 , 8 , 10 ]
- Lawson said no misuse of the information had been confirmed so far. [ 4 , 6 ]
- Karaoke operator Daiichikosho (第一興商) announced that about 8.72 million customer records may have leaked. [ 3 , 8 , 10 ]
Confirmed by several sources
- Lawson's "Lawson ID" service was accessed without authorisation by a third party and personal information tied to about 2.155 million IDs leaked. [ 1 , 3 , 6 , 8 , 10 ]
- The leaked information includes names, phone numbers and addresses. [ 3 , 4 , 6 , 8 , 10 ]
- The unauthorised access took place in September. [ 4 , 6 , 8 , 10 ]
- Lawson said no misuse of the information had been confirmed so far. [ 4 , 6 ]
- Lawson issued a statement deeply apologising for the trouble caused. [ 3 , 6 , 8 , 10 ]
- Daiichikosho said about 8.72 million customer records may have leaked. [ 3 , 8 , 10 ]
Still unclear
- How the third party gained access to Lawson's systems. None of the documents says how the access was carried out.
- Whether the access was found through Lawson's regular checks or a specific investigation on October 7. Asahi said it was found through regular investigations; Tokyo Shimbun said an investigation carried out on October 7; TBS NEWS DIG said security monitoring did not detect it.
- The exposure of partial credit card numbers for 26 Lawson App Reservation users. Only Asahi Shimbun reports the credit card detail.
- How Daiichikosho's leak occurred. Only Sankei Shimbun reports that a contractor employee's device was infected with malware.
What local media are saying
Timeline, local time
- Livedoor News reports unauthorised access at Lawson leaking about 2.155 million personal data records. [ 1 ]
- Sankei Shimbun reports the Lawson leak and Daiichikosho's possible leak of about 8.72 million records. [ 3 ]
- Asahi Shimbun reports the leak, including partial credit card numbers for 26 Lawson App Reservation users. [ 4 ]
- TBS NEWS DIG reports 2,155,345 Lawson ID records leaked, about 10% of members. [ 6 ]
- Tokyo Shimbun reports the unauthorised access took place on September 12 to 14. [ 8 ]