> JapanHacked_
[Resolved][Severity: Major][Insider]

Tokyu Community: a former employee took data on about 5,000 apartment residents from the management system in two rounds and gave it to an outside company

A former employee took residents' personal data in October 2019 and November 2020 and passed it to a third-party company.

Disclosed

2021-03-29

Organizations involved

1

Leaked or at risk

5K

5,000

Downtime

Unknown

What happened

  1. The company announced the case. An outside tip in January 2021 raised suspicion of the October 2019 theft, and it investigated with lawyers and a specialist firm. In March the specialist firm found traces of the November 2020 theft, and an interview with the former employee confirmed both. [1] [4]

Impact

In October 2019 the person took building names, room numbers and names of about 3,900 people, and in November 2020 building names, room numbers, names, addresses and phone numbers of about 1,100 people: about 5,000 in total, residents tied to 25 apartment management associations. [1] [2]

Through lawyers, the company demanded that the recipient company stop using the data and destroy it, and is preparing for criminal charges against the former employee. No damage has been reported. [1]

Timeline

  1. Disclosed 2021-03-29
  2. 1 days

Attack or cause

Method
[Insider]
Impact
[Data leak]
Entry point
Unknown

Data exposed or at risk

[Name][Postal address][Phone number]

Organizations involved

Open in organization search

Sources

  1. [1][Official]元弊社従業員による不正な個人情報の持ち出し及び流出に関するお詫びとご報告Tokyu Community · 2021-03-29
  2. [2][News]従業員が個人情報約5000人分を持ち出し、外部提供 - 東急コミュニティーSecurity NEXT · 2021-03-29
  3. [3][News]東急のグループ会社で約5000件の個人情報が流出 元従業員が不正に持ち出しITmedia NEWS · 2021-03-29
  4. [4][News]東急コミュニティー元従業員が社内業務管理システムから個人情報持ち出し、マンション居住者データ5,000件を他社へ提供ScanNetSecurity · 2021-04-01 08:00