Green Monster: user data taken through the FX Navi demo trading app API

On October 17 Green Monster noticed unauthorized access to FX Navi, its demo trading app for foreign exchange, and began investigating. The investigation found that from about 20:26 on April 27 to about 14:26 on April 30, a third party at a different IP address may have kept pulling user data through a function of the app's API. About 6.19 million items are affected, including data that is not personal. They include 66,003 email addresses, about 140,000 each of genders, age groups and job categories, 6,434 X IDs, 4,809,631 first-survey answers and 5,120 transfer codes, plus device IDs, login credentials and trading results. Names, addresses, phone numbers, cards and bank accounts are not collected by the app. The company fixed the API and revoked all credentials issued before the fix. No leak was found from the October 17 access itself.