LY Corporation: contractor PC malware led to access to former LINE systems, and up to about 520,000 records leaked

1. 2023-09-14

   Unauthorized access to its internal systems began, triggered by malware on the PC of an employee of a contractor. It first announced a start of October 9, and changed it to September 14 in its December 27 update. [2]

2. 2023-10-09

   The former LINE internal systems were accessed through the systems of NAVER Cloud in Korea. The network connection to them was allowed through a common authentication base handling staff data of both companies. [1] [3]

3. 2023-10-17

   Its security team detected suspicious access and began investigating. [1] [3]

4. 2023-10-27

   It judged that outside unauthorized access was likely. It reset staff passwords and began blocking access from the affiliate's systems. [1] [3]

5. 2023-10-28

   It forced staff to log in again to internal systems. [1]

6. 2023-11-27

   It announced the case and began notifying users and staff. [1] [3]

7. 2023-12-27

   In its continued investigation it confirmed a further 369 user records leaked. [2] [4]

8. 2024-02-14

   After additional checks including outside services, it confirmed newly leaked data in email and Slack used for internal communication and finished the final investigation. [2]

9. 2024-03-05

   The Ministry of Internal Affairs and Communications issued written administrative guidance to ensure protection of the confidentiality of communications and cybersecurity, and to report on the preventive measures it takes. [5]

10. 2024-03-28

    The Personal Information Protection Commission announced administrative action (guidance) under the Act on the Protection of Personal Information. [6]

11. 2024-04-16

    Following LY Corporation's report, the Ministry of Internal Affairs and Communications announced measures to ensure protection of the confidentiality of communications and cybersecurity. It was the second administrative guidance. [7]

The final counts are 302,980 user records (130,192 of Japanese users), 86,211 business partner records and 130,315 staff records. User data includes usage history tied to LINE internal identifiers, and 22,239 records fall under confidentiality of communications. The counts include estimates. Bank data, credit card data and LINE chat content are not included. [2]

Most business partner data is 86,071 outside email addresses on mailing lists. Staff data is names, employee numbers, email addresses, face photos and the like, counted as accounts with duplicates. As of November 27, 2023, no secondary harm using the data had been reported. [1] [2]