Rakumachi: attackers exploited a web server flaw, planted a backdoor and took data from the database, and personal data of about 563,000 members and inquirers may have leaked

1. 2025-06-10

   At about 19:00, while investigating a site error, it noticed abnormal load on the database server. It stopped a suspicious command but the problem returned, and after finding suspicious behavior on several web servers it concluded around 20:35 that it was unauthorized access. It deleted files believed to be backdoors and blocked the access path. [2]

2. 2025-06-12

   It announced the incident and reported to and consulted the police and the Personal Information Protection Commission. [1] [3]

3. 2025-07-29

   It published the findings and the wider scope, and decided to cut executive pay. [2] [4]

An outside investigation found that the attacker exploited a flaw in the web server of the time, planted a backdoor and ran commands to take information from the database. Because the actual number leaked could not be determined, it treated all information in the attacked database as possibly leaked. [2]

Those covered are about 170,000 members who registered only an email address (email address, password), about 310,000 members with basic details (name, email address, password, phone number, address, income and asset information), about 23,000 corporate partner shops (company name, representative and contact names, address, email address, password, property details and more), and about 60,000 people who applied for seminars, used bulk valuation services or inquired about properties. Passwords were stored encrypted. ID document and income proof data and card data were not included. [2]