Dentsu Soken (then Information Services International-Dentsu): a remote access device was attacked and 13,706 records may have leaked from its account management system

1. 2023-05-09

   It detected an external attack on the remote access device used by the company and its group companies. It contacted the device maintenance vendor and a security specialist vendor and took the necessary measures the same day. [1] [2]

2. 2023-05-16

   It reported to the Personal Information Protection Commission and the Japan Information Technology Services Industry Association (JISA). [1]

3. 2023-06-02

   It emailed a notice to the people whose data may have leaked. [1]

4. 2023-06-06

   It announced the case. [1] [2]

5. 2023-07-05

   It published a second report. A third-party investigation ended and confirmed that the attacker only referenced data in the account management system (directory server) with general user privileges and left no other trace. Data that may have leaked is user IDs, email addresses, names, department names, organization codes and employee numbers of staff and group company staff (including former ones), similar data and company names of contractor staff, and email addresses of customers and partners registered in group addresses. It filed a final report with the Personal Information Protection Commission and others on June 28. [3] [4]

A later investigation found traces of data being read with general-user rights in the account management system (directory server), and that part of the personal data may have leaked. In total 13,706 records are concerned: 3,413 staff account records of the company and group companies (user ID, email address, name, department, organization code, employee number), 4,665 account records of partner company staff (user ID, email address, name, company, outside-party code) and 5,628 email addresses of clients and business partners registered in group addresses. No unauthorized access to other servers has been confirmed. [1] [2]