Smaregi: store customer data leaked from an app linked to its POS

On 8 January it emerged that member data held by the outside vendor of an app sold on the Smaregi app market had been taken and published by a third party. The data belonged to customers of stores at 8 companies that had linked the app; the 13 January update listed 136,346 names and 114,951 phone numbers as possibly leaked. No intrusion into Smaregi servers was found. Sakai Cycle, one of the stores, disclosed the leak of its customer data on 9 January. The March 9 final report named the external vendor as coastline and announced stronger vendor screening and periodic security audits. The vendor's March 5 final report gave revised leaked-field counts of 110,359 names and 100,293 phone numbers and attributed the breach to database configuration and access-control deficiencies.