Bookoff Group Holdings has added two items to the member data that may have leaked in its recent breach: occupation and nickname. The company says the correction widens the list of fields, not the number of people or records involved. Earlier Tokyo Brief coverage
What changed
On 16 October the company issued correction notices to its second breach report of 13 October and to its first-quarter supplementary materials. Both say occupation and nickname were omitted from the fields listed as potentially leaked.
The corrected list for app, online-store and web members now reads: name, date of birth, gender, occupation, nickname, email address, phone number, registered postal code and address, password hash, point-card number and member number.
What did not change
Bookoff states that the data-record count, the affected-person count and other published content are unchanged. The second report put the figures at 6,427,735 member records and 6,383,279 people, including 6,170,908 active members and 212,371 who had left. People are counted once per email address, which is why records exceed people.
The exclusions also stand. Credit-card and bank details, text read from in-store identity documents, separately specified delivery details and images of identity documents submitted for home-delivery purchases are listed as not affected.
Cost still unquantified
The quarter's results are unaffected, Bookoff says, because the incident came after the first-quarter period ended. The effect on the full-year forecast is under review and is not in the current guidance. The supplementary materials say the company will disclose any forecast revision promptly.
The company said it would begin emailing affected members from 15 October, in sequence, and asks them to change their passwords.