Sekisui House: SQL injection on a member site leaks email addresses and passwords

On 24 May 2024 Sekisui House said its homeowner member site Sekisui House Net Owners Club had been attacked through a photo gallery page used from 2008 to 2011 and no longer operated, which had a security setting flaw, using a language for manipulating databases. It came to light on 21 May when its server contractor reported a surge in traffic and high load. Email addresses, login IDs and passwords of 108,331 members leaked, and a leak cannot be ruled out for another 464,053. Email addresses and internal system passwords of 183,590 group employees and partner staff also leaked, with 72,194 more possibly affected. The site was shut down on 23 May. No addresses, phone numbers or card data leaked. The later FAQ says the follow-up investigation did not confirm leakage for people notified as having a low leak risk.