> JapanHacked_
[Contained][Severity: Major][Lost device]

BANDAI SPIRITS: a contractor discarded a personal hard disk with data on it, and "Premium Bandai" member data may have leaked

A contractor employee threw away a personal disk used for work without erasing it. 233 email addresses and 1,951 names, addresses and phone numbers of members may have leaked.

Disclosed

2024-06-11

Organizations involved

1

Leaked or at risk

Unknown

Downtime

Unknown

What happened

  1. A contractor employee began using a personal external disk for work. Around the end of December 2023, the employee threw the disk away without deleting the data. [1] [3]

  2. A person who had obtained the disk contacted the contractor and said it held the contractor's data. Investigation found that it contained Premium Bandai customer data. [1] [3]

  3. It announced the case. It said that it was monitoring the dark web and elsewhere but had found no sign of a leak, and judged that a leak was very unlikely. It had reported to the Personal Information Protection Commission. [1] [2] [3]

Impact

Covered are 233 email addresses of some participants in a campaign in November 2012, and 1,951 addresses, names and phone numbers of customers shipped to on November 18, 2013. Login passwords and credit card numbers are not included. [1] [2]

Timeline

  1. Detected 2024-04-06
  2. Disclosed 2024-06-11
  3. 66 days

Attack or cause

Method
[Lost device]
Impact
[Data leak]
Entry point
Supplier

Data exposed or at risk

[Name][Postal address][Phone number][E-mail address]

Organizations involved

Open in organization search

Sources

  1. [1][News]委託先が私物HDD使用、データ削除せず廃棄　「プレミアムバンダイ」顧客情報漏えいの可能性ITmedia NEWS · 2024-06-14
  2. [2][News]「プレミアムバンダイ」情報漏えい　謝罪　委託先が外付けHD取り扱いに不備「事態を厳粛に受け止める」Sponichi Annex · 2024-06-12
  3. [3][News]「プレミアムバンダイ」会員情報漏えいの可能性、委託先従業員が私物ハードディスクを使用ScanNetSecurity · 2024-06-19 08:05