The Shimane Bank: seven optical discs recording transactions at seven ATMs went missing, holding katakana names and account numbers for 28,553 accounts
An inspection of the discs that store ATM transaction records revealed the loss. They were probably destroyed by mistake, and they were encrypted.
Disclosed
2021-01-18
Organizations involved
1
Leaked or at risk
28.6K
28,553
Downtime
Unknown
What happened
Impact
The missing discs recorded transactions at the ATMs of the head office, Gakuendori, Saigo, Gotsu, Hamada, Yonago and Kurayoshi branches between January 2017 and August 2020, for 28,553 accounts in total. [1] [2]
The records hold the customer's katakana name, bank and branch codes, account number, transaction amount and balance. For transfers they also hold the recipient's katakana name, bank, branch and account number and the sender's phone number, and for credit-related transactions the credit number. PINs, birth dates and addresses are not recorded. [1] [2]
The bank thinks the discs were most likely discarded and melted by mistake. Because they were encrypted and no misuse has been found, it judged the risk of leakage outside to be extremely low. It opened a dedicated inquiry line. [1] [2]
Timeline
- Detected 2020-12-28
- Disclosed 2021-01-18
- 21 days
Attack or cause
- Method
- [Lost device]
- Impact
- [Data leak]
- Entry point
- Unknown
Data exposed or at risk
Organizations involved
[Breached][Moderate]Shimane, MatsueFinance and insurance28,553 leaked
The Shimane Bank, Ltd.
Sources
- [1][Official]お客さま情報が記載された記録媒体(DVD・CD)の紛失(誤廃棄)についてThe Shimane Bank · 2021-01-18
- [2][News]ATM7カ所で取引内容を記録したメディアが所在不明 - 島根銀Security NEXT · 2021-01-20