> JapanHacked_
[Resolved][Severity: Moderate][Lost device]

The Shimane Bank: seven optical discs recording transactions at seven ATMs went missing, holding katakana names and account numbers for 28,553 accounts

An inspection of the discs that store ATM transaction records revealed the loss. They were probably destroyed by mistake, and they were encrypted.

Disclosed

2021-01-18

Organizations involved

1

Leaked or at risk

28.6K

28,553

Downtime

Unknown

What happened

  1. An inspection of the media holding ATM journals found that two discs for two ATMs were missing. [1] [2]

  2. A check of all ATMs found seven discs missing in total, for seven ATMs, and the bank disclosed the case. [1] [2]

Impact

The missing discs recorded transactions at the ATMs of the head office, Gakuendori, Saigo, Gotsu, Hamada, Yonago and Kurayoshi branches between January 2017 and August 2020, for 28,553 accounts in total. [1] [2]

The records hold the customer's katakana name, bank and branch codes, account number, transaction amount and balance. For transfers they also hold the recipient's katakana name, bank, branch and account number and the sender's phone number, and for credit-related transactions the credit number. PINs, birth dates and addresses are not recorded. [1] [2]

The bank thinks the discs were most likely discarded and melted by mistake. Because they were encrypted and no misuse has been found, it judged the risk of leakage outside to be extremely low. It opened a dedicated inquiry line. [1] [2]

Timeline

  1. Detected 2020-12-28
  2. Disclosed 2021-01-18
  3. 21 days

Attack or cause

Method
[Lost device]
Impact
[Data leak]
Entry point
Unknown

Data exposed or at risk

[Name][Bank account][Phone number][Payment card]

Organizations involved

Open in organization search

Sources

  1. [1][Official]お客さま情報が記載された記録媒体(DVD・CD)の紛失(誤廃棄)についてThe Shimane Bank · 2021-01-18
  2. [2][News]ATM7カ所で取引内容を記録したメディアが所在不明 - 島根銀Security NEXT · 2021-01-20