Yama-Kei Publishers: data of 29,431 early Yamakei Online members was traded on the dark web

1. 2020-04-13

   A third party alerted the company, which began checking. [2]

2. 2020-04-14

   The company found that member data from before the system replacement of 2013-04-09 was being traded on the dark web. [2]

3. 2020-04-18

   Public disclosure; the affected members' passwords were reset and they were told by email. [1] [2]

Email addresses, login passwords, birth dates, phone numbers and other data of 29,431 members who registered before 2013-04-09 leaked. [2]

The site had been hit by SQL injection in July 2015 and November 2017. The old data that leaked sat where the 2015 web application could reach it, and the company said it was checking the link to the 2015 attack. The old data has since been deleted from the server. [2]