Peatix Japan: an intrusion into the Peatix event service leaked data on up to 6.77 million members

1. 2020-10-16

   From this day to the 17th, a third party broke in and pulled out member data. [1] [2]

2. 2020-11-09

   The company received information that member data had been taken and began investigating. [1]

3. 2020-11-12

   Investigators confirmed that member data had leaked. [3] [4]

4. 2020-11-14

   The company reinforced database security and cut off the route used for the leak. [3] [4]

5. 2020-11-15

   It invalidated the passwords of all members. [3] [4]

6. 2020-11-17

   It announced that data on up to 6.77 million members had leaked. [1]

7. 2020-11-17

   It began emailing all members, finishing by November 23. [3] [4]

8. 2020-12-16

   It published the investigation results: neither the attacker nor the method of intrusion could be identified. [3] [4]

The leaked data includes names, mail addresses, encrypted passwords, display names, language, country and time zone, and covers every member who registered before October 17. The company said card data and bank accounts were not included. [1] [2]

Every member's password was invalidated, and members were asked to set a new one when logging in. [1]

The investigation found no sign of SQL injection, DoS attacks or malware, and no unauthorized access after October 18. [3] [4]