Selectable Gold Benefits: subcontractor’s cloud breach exposes identifiers for 198,660 people

A development/maintenance cloud used by Office Tandem, subcontracting through Forestech for Benefit One, was accessed at 18:05 on 19 October and an API key exposed. It detected the access and revoked the key at 22:00 on the 21st, removing affected cloud data on the 28th. Logs provided on 4–5 November confirmed access using the key and exposed personal data. The notice describes a different environment and timeline from the Toku-kai server access starting on 14 October. [1]

Credit Saison gives 198,660 people after deduplication: 2,617 with profile data and three identifiers, 5 with profiles and two identifiers, 42,358 with Credit Saison and Benefit One customer numbers, and 153,680 with only Credit Saison identifiers. Profiles may include name/readings, gender, birth date, phone, email and postal code. Names and contacts were not exposed for everyone. [2] [1]

Card numbers, expiry and security codes were not held in the affected systems and did not leak. Intrusion into Credit Saison’s own systems is unconfirmed. The service was stopped as a precaution on 22 October, without a reopening date pending investigation/prevention. Secondary harm is unconfirmed and affected users are being contacted. [2] [1]