Joshin: unauthorized access

Joshin Corporation, which runs the Joshin electronics chain, noticed anomalies in its network on 16 October and cut off servers showing signs of unauthorized access, which stopped some services. Its second report on 26 October said up to about 6 million records with names, addresses, phone numbers and member numbers on the member database server may have leaked, as well as up to about 230,000 records of its Joshin subscription service, including member numbers, phone numbers, handwritten signatures, login IDs with initial passwords, billing history and contract numbers. About 800 records in its renovation photo upload system include construction photos plus two driver's licence images, one My Number card and five bank account numbers; those customers are being contacted individually. All figures are possible maximums, and the company holds no card data. It reported the case to the Personal Information Protection Commission and the police.