Kirin Holdings said on 16 October that a third party broke into the online shops of its subsidiary Fancl and Fancl's consolidated subsidiary Attenir, and that member data was leaked. In its disclosure, the company said it has seen no misuse or secondary damage attributable to the incident as of that day.
What was taken
The leak covers 393,785 records for 368,184 Fancl members and 441,162 records for 417,312 Attenir members. The notice gives counts of records and of people separately for each company, and it does not say whether any individual is a member of both sites.
For each company the exposed data includes email address, name, address, phone number, date of birth, sex and customer number. It also covers a sub-email address and its hashed password, the answers-excluded security questions used for identity checks, and other membership details: points, member stage, newsletter preference and whether the member has bought in a store. Kirin said credit card and other payment information was not part of the affected data.
Only some members set the hashed secondary password, according to the notice, and it cannot be read as it stands. The main password is not affected.
Timeline and response
An internal investigation on Thursday 15 October found that the two online shops were accessed without authorisation between Saturday 3 October and Saturday 10 October. Further checks then confirmed that part of the members' data had leaked.
The companies set up an emergency response headquarters on the day the breach was found, identified the function that had been attacked and shut it down. They are continuing the investigation, have reported the incident to the Personal Information Protection Commission and have consulted the police. Kirin said it has found no other related unauthorised access or malware infection, and no material effect on either company's business or services.
Financial effect
Kirin said it is still examining the effect on consolidated results and will disclose promptly if a material impact on future earnings emerges. The notice gives no cost estimate. Fancl will issue a further notice if new facts emerge.