Tokyo Gas Engineering Solutions: intrusion may have exposed personal data of about 4.16 million people

On 17 July 2024 Tokyo Gas and its subsidiary Tokyo Gas Engineering Solutions (TGES) said an intrusion into the TGES network may have exposed data on TGES servers and on Tokyo Gas servers for its corporate business. It covers about 4.16 million consumers whose data client organizations had provided (names, addresses, contacts), about 3,000 TGES employees and others (names, addresses, about 1,000 bank account numbers, 8 card records), and contacts at corporate customers (count under investigation, including 85 bank account numbers and 5 My Number records). According to Nikkei xTECH, the intrusion was detected on 26 June; the attacker came in through a VPN device and stole several employee IDs and passwords that gave access to file servers. There was no encryption or ransom demand. The clients were 51 gas and water utilities; Kanagawa Prefecture said about 37,000 customers of its water service were affected, and Okayama Gas about 120,000 records. Keiyo Gas said on 18 July that some of its customer data may have leaked; Tokyo Shoko Research counts about 810,000 people. At the time of the announcement, no trace of a leak or misuse had been found. Okayama Gas's 17 October follow-up says expert investigation considered actual leakage unlikely, while not fully ruling it out.