Shogakukan: education-site breach may expose login tokens and registered children’s data

Data cached by the two sites for Shogakukan ID login integration is affected. On 27 October it identified unauthorized access during a vulnerability window from 17 July to 25 August. The flaw was fixed on 25 August and all login tokens invalidated on 29 October. The exact attack start and flaw are not stated. Intrusion into Shogakukan ID itself is unconfirmed; this is separate from the outsourced-email incident. [1]

Potential fields include internal member codes, login tokens, nicknames, gender, age, occupation, prefecture, preferences, services and paid-article history. Registered children’s names, readings and birth dates may be included. Email is involved only when used as a nickname. Members’ own names, full addresses, phones, birth dates, ordinary registered email, cards and Shogakukan ID passwords were not stored and are excluded. No count is disclosed. [1]