Tottori City: three intrusions into the Tottori-ichi online shop leaked 59,021 orders and member passwords

1. 2019-07-12

   In the first intrusion, member and order data was stolen. [2]

2. 2020-02-18

   In the second, data on hometown tax donors and the shops was stolen. [2]

3. 2020-03-15

   In the third, system data other than personal data was stolen. [2]

4. 2020-04-30

   A shop reported receiving a phishing email, and the logs then showed the damage. [2]

5. 2020-05-04

   Public disclosure; the site was shut down. [1] [2]

• 27,270 member records and 59,021 order records, including non-members: names, addresses, phone numbers, birth dates, genders, email addresses and donation amounts. Member records also held IDs and passwords. [2]
• 20 hometown tax donors: names, addresses, contact details, donation amounts, gifts and delivery addresses. [2]
• 20 shops: shop names, representatives, addresses, phone numbers, email addresses, bank accounts for payouts and contact names. [2]

The city investigated the cause and urged anyone using the same ID and password elsewhere to change them. [2]