World, the Tokyo Prime-listed apparel group, said a third party gained unauthorized access to the business server of one of its consolidated subsidiaries, and that some member information stored there may have leaked externally. The company framed the exposure as a possibility, not a confirmed leak.
Timeline
The intrusion began around 14:51 on 17 October, when the outside party entered the server and ran operations to extract data. The subsidiary detected the unauthorized activity around 12:08 on 28 October and isolated the server. By 21:36 that day it had blocked the access route and halted part of the related internal business systems, and it confirmed afterwards that the route could no longer be used. On 29 October the company consulted the police and reported to Japan's Personal Information Protection Commission.
What may have leaked
Investigation so far has identified about 1.2 million records of member information as possibly leaked, counted as a cumulative total. The fields are name, address, phone number, date of birth, gender and email address. World said it has not confirmed any leak of credit card or other payment information, or of facial information. The notice says the affected members and the exact record count are still being checked.
Next steps
World plans to commission outside security specialists to investigate and to take recurrence-prevention measures based on their findings and advice. It will post an apology and warning on its website and email affected members individually, once preparations are complete, with no date given. The company said it is still assessing the effect on current-year earnings and will disclose anything material. The notice does not name the attacker or say how the intruder got in.