NTT Marketing Act ProCX: a former dispatched worker on its call-center system took about 9 million customer records

1. 2023-07-13

   A police investigation began. [3]

2. 2023-10-17

   NTT Marketing Act ProCX and NTT Business Solutions announced the case jointly. A former worker dispatched to NTT Business Solutions, which operates and maintains the call-center system, abused system administrator accounts to reach the servers that store customer data, took the information and passed it to third parties. NTT West announced the same day that its own customer data was included. [1] [2] [3]

3. 2023-11-17

   Ozio, which outsourced telemarketing until April 2016, announced that data of 1,528 "Ozio" customers and 3,455 "Natulife" customers was taken. It covers customers who ordered by phone between April and December 2013 and includes credit card data in 19 and 48 cases. At this stage it has not confirmed that anything was passed to third parties. [4] [5]

4. 2023-12-19

   In a follow-up it said that, after internal analysis and cooperation with the police, 9.28 million records of 69 clients had been taken. Records that cannot be tied to a specific client numbered 1.17 million. [6] [7]

5. 2024-01-24

   The Personal Information Protection Commission announced administrative action (guidance) against NTT Marketing Act ProCX and NTT Business Solutions. [8]

6. 2024-01-31

   NTT Business Solutions announced that the former dispatched worker had been arrested by Okayama Prefectural Police. [9]

7. 2024-02-29

   NTT West, NTT Marketing Act ProCX and NTT Business Solutions announced measures to strengthen information security in the NTT West group, and the departure of the NTT West president. [10]

About 9 million customer records of 59 clients were taken (name, address, phone number and so on). The client count is what is known at present, and further findings are to be published. 81 card records of some clients are also included. [1] [3]

About 1.2 million NTT West customer records, from telemarketing done intermittently between April 2014 and March 2022, are included. They hold name, address, phone number and in part birth date, and no credit card or bank account data. [2]

In the follow-up, the records taken rose to 9.28 million and the clients to 69, from about 9 million and 59 at the October announcement. The investigation continues, and the figures may change again. [6] [7]