Sony Shogaku Tanki Hoken: test-system breach exposes 108 employee and contractor records

On 20–21 October, an attacker exploited a web-system flaw in a contract-management development/test environment, searching for and acquiring data. Test records included 108 real employee/subcontractor records, including former employees: names, gender, birth dates, email, postcodes, addresses and phones. Cards, bank accounts and My Number are excluded. [1]

External access to the environment was blocked; the Kanto Local Finance Bureau was notified on 21 October, also serving as the PPC report. The production attack failed and customer data acquisition is not confirmed. Applications and customer pages remain available, with individual notifications underway. This is not combined with Sony Life’s separate breach. [1]