RAKUS Light Cloud: unauthorized access to the blastmail email delivery service

At 00:30 on 21 October, RAKUS Light Cloud, a RAKUS subsidiary, detected suspicious access to its blastmail email delivery service and shut it down. Its second report that day confirmed that a third party broke into two API servers, ran commands, and took data from the sales management system and the service database. Company names, contact names, phone numbers, emails and contract and payment history of all customers were taken, and some customers' mailing lists also leaked. Users such as JAPEX, JR Shikoku (about 30,000 records), Meitetsu World Travel (about 130,000 people), Nulab and Tokamachi City disclosed their own impact. On the evening of October 22, Niigata Nippo confirmed exposure of all Passport members, up to about 253,000 people. On October 22, Tohoku EPCO Frontier reported possible exposure of up to about 100,000 emails/internal IDs, with actual leakage of its members' information unconfirmed. From October 22 to 23, Tokyo Metro (about 80,000 email addresses confirmed taken), H.I.S. Hotel Holdings (about 140,000 hotel members), Kyodo News for its 47 Gyosei Journal (up to about 500 people), Mac House operator Gyet, the Japan Council of Shopping Centers, contracted programs of Nagano and Toyama prefectures, and a Tokyo Metropolitan Government affiliate also disclosed their impact. Utsunomiya City also said email addresses of about 1,700 subscribers to the mail of teamNEXT, its citizen supporters' group for the LRT, may have leaked. The Ministry of the Environment also said on October 23 that names, email addresses and more in up to about 22,000 registrations for six of its mail magazines may have leaked. NHK Publishing said the full mailing list of about 127,000 newsletter members of its Minna no Shumi no Engei site had leaked. Hiroshima City said 4,424 registrations for two newsletters, including that of its industrial promotion center, may be affected. Okazaki City named about 26,000 email addresses registered for its crime prevention mail and others, the Sasakawa Sports Foundation about 12,000 newsletter subscribers, and HR software maker Cells up to about 18,000 mailing list entries. Kanehara & Co. said its newsletter subscribers' email addresses may also be affected. On 24 October Kakaopiccoma said 1,002,404 email addresses that received one issue of the piccoma newsletter had leaked. Ichinoseki City said on the 22nd that the email addresses registered for Ichinoseki Mail had leaked, and on the 25th Creema said some of its newsletter addresses had leaked. As of the evening of 26 October, leaks of data beyond contract holder details were confirmed for 345 contracts, all contacted individually, and the service had stayed down since the 21st. HR Vision, operator of the HR portal Nihon no Jinjibu, said it confirmed that 212,243 newsletter email addresses had leaked. Sompo Japan DC Securities and the Bank of Nagoya, which used it for corporate pension emails, also announced a possible leak but later said none had been found. On the 27th Daihatsu Motor said the provider had told it that names, company names, job titles and email addresses registered on its Daihatsu Media Site for the press had leaked; the site is down.