Hokushu: unauthorized access to its servers, and files with transaction data containing personal data may have been opened

1. 2024-03-11

   It found the unauthorized access to its servers. It cut the network connections to the outside at once and reported to and consulted external specialists. [1]

2. 2024-03-12

   Initial investigation confirmed a malicious attack from outside, and it notified Miyagi Prefectural Police. [1]

3. 2024-03-13

   It asked external specialists for a detailed investigation. [1]

4. 2024-03-15

   It announced the case. Miyagi Prefectural Police accepted its damage report. [1]

5. 2024-04-30

   It received the investigation report from external specialists. [1]

6. 2024-05-21

   It published the investigation results. [1] [2]

No trace of data being taken out or leaked was found, and it judged that taking data out was very unlikely. Some files may have been opened by the attacker, however, and they held transaction data containing personal data of 34,902 people in total. It concluded that the case is a "risk of personal data leak" under the Act on the Protection of Personal Information. [1]