Iseto: ransomware leaks data of about 3.07 million people from about 100 client organizations

[Through a supplier][Critical]Tokushima, TokushimaPrefecture144,455 leaked

Print data for the 2023 automobile tax (132,503 individuals and 7,691 businesses), 4,260 status reports for tax-exempt vehicles from 2022 and more, with names, addresses, tax amounts and licence plate numbers, leaked. Iseto had not deleted data it reported as deleted after the contract ended and had handled it on its core network instead of the intended one.

[Through a supplier][Critical]Aichi, ToyotaMunicipality148,620 leaked

Had outsourced the printing of tax notices and other mail to Iseto.

[Through a supplier][Critical]Wakayama, WakayamaMunicipality151,421 leaked

Data from the 2023 special collection resident tax notices (135,118 individuals and 16,303 businesses): addresses, names and tax details. Iseto had copied the data to another department's server and kept it after the contract ended instead of deleting it.

[Breached][Critical]Kyoto, Kyoto, NakagyoInformation and communications3,076,477 leaked

[Through a supplier][Critical]Ehime, MatsuyamaFinance and insurance254,659 leaked

Addresses, names, transaction dates and amounts, account details and more leaked. Iseto had kept the work data on a server not meant for it and had not deleted it after the job.

[Through a supplier][Critical]Osaka, Osaka, YodogawaEducation and learning support739,714 leaked

Names, member numbers, materials, classrooms, school years and more of 739,714 members leaked (birth dates and parents' names for Baby Kumon members). Also affected: addresses, phone numbers and iKUMON authentication codes of 4,678 members announced earlier, and names, addresses and bank account details (last three digits masked for all but one) of 17,481 instructors.

[Through a supplier][Major]Tokyo, ChiyodaFinance and insurance

Outsourced printing and mailing of statements; announced that personal data it provided leaked (no count given).

[Through a supplier][Major]Osaka, Osaka, KitaFinance and insurance61,424 leaked

Print data for September 2022 statements and invoices (names, addresses, purchase and billing details, part of the debit account details) leaked. Iseto had left data it should have deleted after the job on its general office network.

[Through a supplier][Major]Kyoto, Kyoto, ShimogyoOther services41,819 leaked

Outsourced form printing and mailing to Iseto. Data on 13,725 member companies, such as company names, representative names, mailing addresses and partial bank account details, leaked (first reported as 41,819 records including duplicates).

[Through a supplier][Major]Tokyo, ShinjukuFinance and insurance1,082 leaked

Names, birth dates, addresses, phone numbers, application numbers and more for 1,082 contracts applied for online between late September and early October 2022 leaked.