A-One Tokyo: its dedicated system was accessed without authorization, and data on customers, applicants and staff leaked
Store accounts on its "IP system" were deleted and data was taken. On New Year's Day applicants received threatening emails about the company.
Disclosed
2022-01-24
Organizations involved
1
Leaked or at risk
Unknown
Downtime
Unknown
What happened
No store account could access the dedicated system any more, and at the same time several threatening spam emails about the company reached applicants' email addresses. It consulted the local police. [1] [2]
It reported to the Personal Information Protection Commission. [1]
Impact
Checks of system logs and more showed that accounts were deleted and data on customers, applicants and staff was taken. The data held in the database on December 31, 2021 is affected: names, ages, genders, phone numbers, email addresses and more, so spam may arrive. In April 2022 the police said they could not continue the investigation because it extended abroad. [1]
Timeline
- Detected 2022-01-01
- Disclosed 2022-01-24
- 23 days
Attack or cause
- Method
- [Intrusion]
- Impact
- [Data leak][Extortion]
- Entry point
- Unknown
Data exposed or at risk
Organizations involved
[Breached][Major]Tokyo, ShinjukuPersonal services and entertainment
A-One Tokyo Co., Ltd.
Sources
- [1][Official]不正アクセスに伴う情報漏洩についてA-One Tokyo Co., Ltd. · 2022-01-24
- [2][News]リラクゼーション店舗運営のエーワン東京の専用システムに不正アクセス、正月に脅迫メール届くScanNetSecurity · 2022-01-31 08:05