Marubeni Power & Infrastructure Systems: a file server was accessed without authorization, and My Number data of 132 people and passport numbers of 241 business contacts may have leaked

1. 2020-06-30

   From around this time, the file server was accessed through a weakness. [2] [3]

2. 2020-07-03

   The company detected an abnormality on the server, stopped it at once and cut off outside access. A security firm investigated and found traces of the intrusion. [2] [3]

3. 2020-07-31

   It reported to the Personal Information Protection Commission, and again on October 1. [2]

4. 2020-08-07

   It filed a damage report with the police. [2]

5. 2021-01-18

   The company disclosed the case. [1] [2] [3]

Details could not be confirmed, but judging from the traffic of the intrusion, several hundred megabytes of about 3.0 terabytes may have been taken. The server held the following personal data. [3]

• My Number of 132 people: employees in 2018 and some of their families, and those who left or joined from 2018 [2] [3]
• Bank account details of 117 employees since 2018 [2] [3]
• Age, birth date, education and health insurance numbers of 256 employees since 2018 [2] [3]
• Names, addresses, birth dates, phone numbers and mail addresses from the CVs and entry sheets of 2,107 new-graduate candidates (classes of 2019 to 2021) and 810 mid-career candidates (2019 to 2021) [2] [3]
• An address book of 375 people from Marubeni's power division and the company since 2008 [2] [3]
• Names, company names, titles and phone numbers of 1,027 business contacts sent greeting cards since 2011 [2] [3]
• Names, passport numbers and birth dates of 241 business contacts for whom the company applied for visas [2] [3]

People whose My Number or account data may have leaked are being contacted one by one, including guidance on changing their My Number or accounts. [2]