Bandai: a misconfigured cloud sales management system at its customer center may have let outsiders see data of 147 customers

1. 2020-12-18

   From this day to January 3, 2021, outsiders could have viewed customer data kept for the customer center. [1] [2]

2. 2021-01-03

   An outsider emailed the Bandai security team BN-CSIRT to point out a flaw in the system. [1] [2]

3. 2021-01-04

   It began an investigation. [1]

4. 2021-01-07

   It stopped accepting contacts at the customer center. [1]

5. 2021-01-19

   It confirmed that the data may have been accessed from outside. [1]

6. 2021-01-29

   The companies disclosed the case. [1] [2] [4]

The affected are 147 customers of Bandai and BANDAI SPIRITS combined. Names, addresses, phone numbers, mail addresses and response records may have been exposed. The cause was a flaw in the security settings of a cloud sales management system, which was shut down. No damage to customers has been found. [1] [2] [4]

Nikkei xTECH reported that the system appeared to be a Salesforce cloud sales management system. [4]