Rakuten Group: a setting error in an outside sales management cloud left up to about 1.49 million records open for nearly five years, and access from overseas was confirmed

1. 2016-01-15

   From this day, a setting error in the outside cloud sales management system used by the group let outside parties reach the data. [1] [4]

2. 2020-11-24

   An outside security expert pointed out that the data was open to outsiders. The group's security unit began responding the same day. [1] [4]

3. 2020-11-26

   The settings were corrected. No outside access has been seen since. [1]

4. 2020-12-25

   The group disclosed the case. [1] [3]

Rakuten Card's count rose from 15,415 to 16,895 in an update on January 26, 2021. The exposure ran from January 15, 2016 until November 24 for Rakuten and until November 26 for Edy and Rakuten Card. Rakuten Card member data sits in a separate system and was not affected. [1] [3]

Third parties accessed some of the data from overseas. No misuse or harm has been confirmed. The group reported to the Personal Information Protection Commission and the supervising ministries and is notifying the companies and individuals who may have been affected. The cause was an inadequate security setting in the use of the outside system, and the group is asking its provider for details. [1]