Sammy Networks: unauthorized access to 777CON-PASS

On 25 and 30 September, a third party sent unauthorized requests that fetched user data from 777CON-PASS, Sammy Networks' app for pachinko and pachislot halls. Weekly load monitoring showed an unusual rise in traffic; on 30 September the source was blocked and the app was changed to return nothing to such requests. Missing authentication and access control in some functions was the cause. 2,188,657 user ID records were taken, with genders, birth dates, nicknames, icon images, activity areas and 6,639 phone numbers from in-store bookings. Face images used for entry, names, emails and passwords were not included.