Takara Holdings and Takara Shuzo: a dummy file for a payroll system migration still held real My Number data and was emailed to an outside developer, covering 4,167 people

1. 2021-03-18

   During the My Number data migration for a new payroll system, an employee made a dummy data file from real data including My Number and forgot to delete the sheet with the original data. The file was emailed to the contracted payroll system developer and to another employee. [1] [2]

2. 2021-03-18

   The same day, another employee who shared the information noticed. The company asked the recipients to delete the email and file and confirmed the deletion. [1] [2]

3. 2021-03-19

   The company announced the case. [2]

The file held the names, birth dates, genders, My Number and other data of 4,167 employees and family members (some of them retirees) who had been with Takara Holdings or Takara Shuzo since August 2016. [1] [2]

The company reported to and apologized to the employees concerned, and reported to the Personal Information Protection Commission. It will also contact retirees and strengthen its information management and training. [1] [2]