Yellow Hat: member data taken through the 2Rinkan app API

At 2Rinkan Yellow Hat, a Yellow Hat subsidiary, attackers took information from inside the 2Rinkan mobile app and, from early on 20 April, called an API that returned personal data without the app, pulling customer data from the web server. The third report on 19 June confirmed 3,179,454 point, mobile and app members leaked: names, addresses, phone numbers, birth dates, genders, emails, member numbers, app IDs and passwords, point balances and vehicle details. The app was restricted, with a restart planned for October. The final confirmed count was reduced from the earlier maximum of 3,455,754.