Zurich Insurance Japan: a contractor set up a server without proper security and data of 692,428 auto insurance customers was posted on the dark web

1. 2023-01-06

   A person who gained unauthorized access started stealing data from the server the contractor had newly set up at the end of 2022. It went on until January 8. [1]

2. 2023-01-08

   The stolen data was posted on a dark web site, until January 9. [1]

3. 2023-01-09

   In the early morning it learned that customer personal data was posted on an overseas site, and an investigation showed a leak. It reported to the supervising authority. [1]

4. 2023-01-10

   It announced the case. At that point it said up to 757,463 people were affected. [2] [3]

5. 2023-01-11

   It confirmed that its customer data had been deleted from the contractor's server. [1]

A later check put the number at 692,428 people (841 of them accident-report records). It covers current and past holders of the "Super Auto Insurance": surname only, sex, birth date, email address, policy number, customer ID, vehicle name and grade. The accident-report records hold the surname, policy number, accident number and accident date. Card numbers, bank account data and My Zurich passwords are not included. The cause was that the contractor did not apply security measures when setting up the server, and it could not detect the unauthorized access at once. [1] [2]