Joshin, the Tokyo Prime-listed electronics retailer, has put numbers on the possible damage from its network intrusion. In a second report dated October 26, the company said up to about 6 million records in its member database server may have leaked. It stressed that the counts are the total number of records that may have been exposed, not a confirmed number of people whose personal information was leaked.
Three systems under investigation
The member database server is the largest. The possibly exposed fields are name, address, phone number and member number.
Joshin's subscription service, listed as the second system, may have lost up to about 230,000 records. The fields named are member number, phone number with a handwritten signature stored as binary data, login ID and initial password, billing history, contract number and device ID, and activation code.
The third system, a renovation photo upload system, covers up to about 800 records. Among them are two driver's licence images, one My Number card and five bank account numbers, along with photographs of renovation work in progress. Joshin said it is contacting the affected customers individually.
The company did not say whether the three datasets overlap, so they should not be added into a single count of affected people.
What Joshin says about cards and services
Joshin said it does not hold credit card information, because it has moved to a model in which it does not retain payment data.
The network remains affected by the unauthorised access, and some services are still unavailable. Joshin detected an anomaly on October 16, found signs that part of the network had been accessed, cut off the servers showing those signs and asked an outside specialist firm to investigate. It consulted and reported to the Personal Information Protection Commission and the police. The Earlier Tokyo Brief coverage covers the first notice.
The second report gives no date for restoring the suspended services. Joshin said it will keep investigating the access, its scope and whether any information leaked, and will publish new facts on its website. It also warned customers to expect suspicious emails, texts and calls that pose as the company, and to be wary of unfamiliar links.