Subway Japan: its file server was infected with ransomware, and information on about 10,000 people such as employees and franchise parties may have leaked, including passport and bank account data

1. 2021-04-14

   It found that its file server in Japan had been accessed from outside and infected with ransomware. [1] [2]

2. 2021-04-26

   It published its first report. [1]

3. 2021-04-30

   It published its second report. [1]

4. 2021-05-27

   It published additional information. The server held about 300,000 Sub Club card membership numbers, and about 80,000 of them were linked to birth dates, prefectures of residence and the like. [1] [2]

• Information on about 10,000 people: current employees, job applicants, franchise owners, franchise staff, franchise candidates, outside public relations and marketing vendors and other suppliers. It includes names, gender, birth dates, nationality, addresses, phone numbers, email addresses, work history, income, marital status, criminal records, credit history, bank accounts, driver's licenses and passports or IDs. Health checkup application confirmations were also stored, but no checkup results. [1] [2]
• Names, ages and phone numbers of 64 customers. [1] [2]
• About 300,000 Sub Club card membership numbers. Names are not registered on the card, so the numbers are not linked to individual names. About 80,000 of them were linked to birth dates, prefectures, occupation categories and marital status categories. [1] [2]

To prevent further access, the company installed strong protection software on endpoints, shut down suspicious data transmission and rebuilt the affected server. It reported to the Metropolitan Police Department and the Personal Information Protection Commission and notified the customers, franchises and employees concerned by post or email in turn. As of May 27, it had not confirmed that the information was published without authorization. [1]