Aizawa Asset Management: an employee's cloud email was breached and about two years of mail taken, leaking data of 2,540 people

1. 2024-04-28

   From about this day until May 13, about two years of mail stored on the cloud mail server of one employee was downloaded in several unauthorized accesses. [1]

2. 2024-05-13

   It sent 811 spam emails urging investment to clients and others from that employee. The password was changed the same day. [1] [2]

3. 2024-05-15

   It found that the mail had been downloaded and leaked, and sent apology emails to those who had received the spam. [1]

4. 2024-05-31

   It published the first report. [1] [2]

5. 2024-07-08

   The forensic investigation by an external body and the identification of the downloaded mail ended. [1]

6. 2024-12-06

   It published the final report, confirming that personal data of 2,540 people leaked. It gave the lack of regular password changes and two-factor authentication as the cause, and the forensics also pointed to a possible leak of a password the employee had registered on an outside site. [1] [2]

The 2,540 people include 94 clients of its financial instruments business (personal names, addresses, birth dates, passport numbers, bank accounts, driver's licence numbers and more) and business contacts and fund-related people (contact names, email addresses, phone numbers and more), among them 1,103 prospective investors and 689 fund operation contacts. No secondary harm was confirmed. [1]