Disc Union: personal data of up to about 700,000 registrants of its online shops "diskunion.net" and "audiounion.jp" may have leaked, and the shops were stopped

1. 2022-06-24

   Prompted by a tip from a third party, it started an internal check and found that personal data of customers registered at its online shops may have leaked. It stopped the shops at 11 p.m. to prevent further leaks. [1] [2]

2. 2022-06-25

   It set up an emergency team and asked an outside firm to investigate. [1] [2]

3. 2022-06-27

   It reported to the Personal Information Protection Commission. [1] [2]

4. 2022-06-28

   It reported the damage to the police. [1] [2]

5. 2022-06-29

   It announced the case and began emailing the customers concerned. [1] [2]

6. 2022-07-08

   It began mailing notices to the customers concerned and reported to the Metropolitan Police Department. [4]

7. 2022-07-13

   An outside security firm began a vulnerability assessment. [3]

8. 2022-07-15

   It issued a follow-up. [3]

9. 2022-07-20

   It finished mailing notices to the customers concerned. [4]

10. 2022-07-27

    The first result of the vulnerability assessment came out. [4]

11. 2022-08-02

    It reported to the police. [4]

12. 2022-08-03

    The forensic investigation finished. [4]

13. 2022-08-10

    It published the investigation results. [4]

The forensic investigation confirmed a leak of about 701,000 records of online shop registrants: names, addresses, phone and FAX numbers, email addresses, login passwords and member numbers. Purchase history was on the same server, but no leak of it was confirmed. One related server had a vulnerability, and nothing leaked from other servers. Payment is outsourced, and the company holds no credit card data. The shop will reopen after the security measures are done. [4]