Aplus, Shinsei Bank and Shinsei Financial: customer login details and email addresses were mistakenly given to web analytics contractors, 475,813 customers at Aplus

1. 2017-08-25

   Aplus began providing data to the web analytics contractors. App login details were included from around this time. [1]

2. 2021-09-03

   Shinsei Bank was checking data returned by a contractor and found that it contained login details. [1]

3. 2021-09-16

   Aplus announced the case. [1]

4. 2021-09-27

   Shinsei Bank and Shinsei Financial announced that they had likewise passed customer data to contractors. [2]

The IDs and passwords used to log in to Aplus's credit card member app NETstation*APLUS, for 475,813 users. There is no sign of leaks beyond the two contractors, and the credentials alone cannot be used to pay by card. [1]

Email addresses of 6,293 customers of Shinsei Bank's card loan Lake and 2,108 of Shinsei Financial. Separately, 37 and 54 records with PINs or account information on the Lake new-application page, and 2 records with member numbers, PINs and birth dates, were included. [2]