and ST HD, the Tokyo Prime-listed retailer, said a third party broke into its business servers and that customer, business-partner and employee information may have leaked. The company disclosed the incident on Oct 23 in a notice apologizing for the breach.
What may be exposed
The company puts potentially leaked customer data at about 2.5mn records: names, birth dates, sex, addresses, phone numbers, email addresses and member IDs. For business partners it cites about 10,000 records covering company names, order and return addresses, contact names, phone numbers and email addresses. The employee scope is still being confirmed. Credit card and other payment information, and passwords customers set themselves, are not included.
The figures are counts of records that may have leaked, not confirmed numbers of affected people. The company has not said how many individuals sit behind them.
Timeline and operations
The attacker made login attempts, intrusions and data extraction across several servers starting around 7:30am on Oct 22. and ST HD detected improper activity around 10:00am and isolated the servers. By 5:00pm it had blocked the access route, stopped internal business systems and confirmed the route could no longer be used.
On Oct 23 it consulted the police and reported to the Personal Information Protection Commission.
Group stores and the web store remain open, and the company says its web store was not affected by the intrusion. Even so, member points cannot currently be used in stores or online.
What comes next
and ST HD says it will begin contacting affected customers and business partners in sequence and set up an inquiry desk. It is still assessing the effect on current-year results and says it will disclose promptly if it expects a material impact.