The Bank of the Ryukyus: a setting flaw in the external cloud of its web application site let a third party access data of 245 customers, including account numbers and encrypted PINs

1. 2021-06-07

   The maintenance company of the system examined the logs of the external cloud management system and reported to the bank that a third party had accessed customer and application information. [1]

2. 2021-06-18

   The maintenance company reported the 445 customers concerned, the information accessed and the probable cause. [1]

3. 2021-06-21

   It began contacting the customers concerned individually by email, post and phone. [1]

4. 2021-06-23

   It suspended the visit reservation service to investigate the cause and take measures. [4]

5. 2021-06-24

   It announced the case after the notices and warnings had gone round, and suspended the Ryugin Web application site and the visit reservation service. [1] [2] [3]

6. 2021-07-06

   It reopened the Ryugin Web application site and the visit reservation service. [4]

7. 2021-08-10

   It published a final report. The accessed data covered 245 customers, not the 445 announced on June 24. It took 64 days from June 7, when the access was found. [4]

A third party accessed the system several times from outside between November 2020 and February 2021. The customers concerned used the site to apply for accounts, internet banking and Visa debit cards, and all have a name and registered email address. Depending on the application, the data includes phone numbers, birth dates, genders, addresses, occupations, workplace names and phone numbers, branch names and numbers, account numbers and encrypted cash card PINs. In applications that were not completed, there were also internet banking logon passwords (2), Visa debit card PINs (3) and a cash card PIN (1). Entries typed partway by people who left without applying were also stored and may have been accessed. [1] [2]

No access to images of identity documents, transaction history, Visa debit card member numbers, expiry dates or security codes was confirmed. The cause was a flaw in the security settings of the external cloud management system. Its core banking systems were not affected, and no harm to customers was confirmed. The bank said this information alone cannot be used for unauthorized withdrawals or logging on to internet banking. More customers may turn out to have been accessed, and it is investigating. [1]

The final report found that 245 customers were accessed. Only the Ryugin Web application site was confirmed to have been accessed; the visit reservation service, which uses the same external cloud, showed no unauthorized access. All cases include the name and registered email address, and some customers also have phone numbers, birth dates, genders, addresses, occupations, workplaces, and the branch name, branch number and account number entered on the application. [4]