> JapanHacked_
[Resolved][Severity: Major][Intrusion]

A-One Tokyo: its dedicated system was accessed without authorization, and data on customers, applicants and staff leaked

Store accounts on its "IP system" were deleted and data was taken. On New Year's Day applicants received threatening emails about the company.

Disclosed

2022-01-24

Organizations involved

1

Leaked or at risk

Unknown

Downtime

Unknown

What happened

  1. No store account could access the dedicated system any more, and at the same time several threatening spam emails about the company reached applicants' email addresses. It consulted the local police. [1] [2]

  2. It reported to the Personal Information Protection Commission. [1]

  3. It announced the case. [1] [2]

Impact

Checks of system logs and more showed that accounts were deleted and data on customers, applicants and staff was taken. The data held in the database on December 31, 2021 is affected: names, ages, genders, phone numbers, email addresses and more, so spam may arrive. In April 2022 the police said they could not continue the investigation because it extended abroad. [1]

Timeline

  1. Detected 2022-01-01
  2. Disclosed 2022-01-24
  3. 23 days

Attack or cause

Method
[Intrusion]
Impact
[Data leak][Extortion]
Entry point
Unknown

Data exposed or at risk

[Name][Gender][Phone number][E-mail address]

Organizations involved

Open in organization search

Sources

  1. [1][Official]不正アクセスに伴う情報漏洩についてA-One Tokyo Co., Ltd. · 2022-01-24
  2. [2][News]リラクゼーション店舗運営のエーワン東京の専用システムに不正アクセス、正月に脅迫メール届くScanNetSecurity · 2022-01-31 08:05