Forestec: unauthorized access to a contractor system leaks data of 29,465 Benefit One Toku-kai members

On 28 October Benefit One said that a system run by its contractor Forestec was hit by unauthorized access and that personal data of 29,465 members (some former) of Toku-kai, a perks service for Credit Saison cardholders, leaked. The access came intermittently from 13:45 on 14 October to 14:05 on 20 October; Forestec detected part of it on 21 October and reported it, and Benefit One stopped the service that evening. More access was found on 24 and 25 October. The data are names with readings, birth dates, gender, postal codes, email addresses, customer numbers, enrollment records and management numbers used for fee payments. Some authentication data used to link to the payment system may also have leaked; Benefit One changed it on 26 October, so that route can no longer be used for fraudulent processing, and no unauthorized payments from 14 to 26 October were found. Card numbers are not held in the affected system and the leak did not come from Credit Saison's systems. It filed a preliminary report with the Personal Information Protection Commission on 23 October.