Yupiteru: personal data of 405,576 members of its member site My Yupiteru was stolen in an unauthorized access in 2017, which came to light in May 2021 through an extortion email

1. 2017-10-31

   It noticed unauthorized access to the member site server. It blocked communication from the source, checked all internal devices and asked contractors and others to investigate. A report said there was no trace of personal data being downloaded, so it decided not to announce the access. [1] [2]

2. 2021-05-25

   An email in Japanese reached a person connected to the company, saying that the sender hacked the server at the end of 2017 and held customer information, and demanding money. The link in the email led to data of 528,563 records. [1] [2]

3. 2021-05-26

   It consulted the police. [1] [2]

4. 2021-06-02

   It reported to the Personal Information Protection Commission. [1] [2]

5. 2021-06-03

   It filed an extortion report with the police. [1] [2]

6. 2021-06-07

   It announced the case and explained the matter to the members concerned by email, apologizing. [1] [2]

The database held 528,563 records, and after removing duplicates and non-personal data it contained 405,576 members of the member site My Yupiteru as of the end of October 2017, including the ity.club and ATLAS CLUB memberships. It included names, gender, birth dates, addresses, phone numbers, email addresses and hashed passwords, and the timestamps in the database were also from that time. The amount demanded was not disclosed. The company said it would not give in to the threat. [1] [2]

The company explained that it could not identify the cause in 2017 and took measures including tighter access restrictions, a check of all devices, stronger malware countermeasures and changes to the member system. [1] [2]