Adastria: servers of its internal business systems were accessed without authorization and up to 1,044,175 personal records may have leaked

1. 2023-01-18

   Early in the morning it confirmed that some servers of its internal business systems had been accessed from outside. It cut the network and stopped the internal systems at once, and suspended the web store "dot st" because the logistics system was stopped. It set up a response headquarters in the morning and consulted the police in the afternoon. It also reported to the Personal Information Protection Commission. [1] [2]

2. 2023-01-19

   It announced the case. [2]

3. 2023-01-24

   A second report said it could not rule out a leak of customers' personal data. No leak has been confirmed. It restarted the stopped internal systems in turn. [1] [3]

4. 2023-03-31

   A third report gave the investigation result. The forensic investigation by an outside specialist firm and the internal investigation finished, and the entry route and affected devices were identified. About 370,000 more records were found that may have leaked. The systems are restored and no leak has been confirmed. [4] [5]

The personal data of 1,044,175 customers may have leaked: name, address, phone number, email address and member identification number. It covers some customers who received or were due to receive goods from dot st from July 2022 to January 2023, some who applied for in-store pickup or home delivery from April 2021 to January 2023, and some who bought on dot st in August and September 2019. Payment data such as card information and the dot st login data are not included. [1] [3]

The information newly found at risk in the third report is: customers who inquired by phone from 2008 to 2013 (name, summary of the inquiry), 221,272 records; employees who belonged to the group since 2008 (including former employees; name, address, birth date, personnel data), 94,435 records; applicants to new-graduate recruitment since 2018, 22,063 records; applicants to mid-career and part-time recruitment since 2005, 26,460 records; and business partners, 6,346 records. Payment data and My Number are not included. [4] [5]