Net Marketing: images of age verification documents of 1,711,756 accounts of the matching app Omiai leaked through unauthorized access

1. 2021-04-20

   From this day until April 26, image data of age verification documents was taken out several times. [1] [4]

2. 2021-04-28 15:00

   Around this time, the company saw many requests for age verification images that normal operation would not produce. It blocked the IP addresses thought to belong to the attacker and made a first report to the Ministry of Internal Affairs and Communications. [1] [4]

3. 2021-04-30

   It made a first report to the police and began consulting them about the damage. [4]

4. 2021-05-05

   It began a forensic investigation with outside specialists and strengthened monitoring. [1] [4]

5. 2021-05-21

   It announced the case, apologized to the members concerned through in-app notices and set up a customer support center. [1] [2] [3]

6. 2021-07-05

   The Japan Privacy Certification Organization decided to terminate all TRUSTe license contracts with Net Marketing over the leak of member information announced on May 21. [5]

7. 2021-07-16

   Net Marketing announced a special loss of 96 million yen for the cost of responding to the leak of member information, and revised its full-year forecast. [6]

8. 2021-08-11

   It published the investigation results and measures against recurrence. [4]

The investigation found that a third party illegitimately obtained the information needed to reach the age verification images and used it to generate a large number of requests for the image data. It did not use malware or a system flaw. Because the requests looked like legitimate data requests, it took until April 28 to detect them. The route was the company's API server, through a cloud server it contracts. [4]

The images of 1,711,756 accounts that submitted age verification documents between January 31, 2018 and April 20, 2021, former members included, were affected. They were driver's licenses, health insurance cards, passports, the front of My Number cards and the like. At first about 60% were described as driver's licenses, and after the investigation licenses and health insurance cards together made up over 90%. They show names, addresses, birth dates, face photos and the registration numbers of each document. The back of a My Number card, which members must not submit, was sent by mistake in one case, so one My Number is included. Credit card data is handled by financial institutions, and the company holds none. [1] [2] [4]

The company said it had confirmed no specific misuse of the data. It said that from December 1, 2021 it would automatically delete age verification images 72 hours after submission, and that the images of the people in this case would be kept encrypted on a server cut off from the internet. [4]