ENKR

Benesse customer data leak

Add to my breach check

Made public · 35,040,000 records after merging duplicates

What leaked8

Hard to replace

  • Mobile number
  • Home or delivery address
  • Email address
  • Other profile data

Permanent

  • Health information
  • Date of birth
  • Full name
  • Gender
  • Health informationexpected delivery date, users of some services only
  • Mobile numberphone number · type not stated; fax number for registered users
  • Home or delivery addresspostal code and address
  • Email addressusers of some services only
  • Full nameregistered user and their child or guardian
  • Other profile datafamily relationship between registered user and child or guardian

To-dos5 · about 1 h 30 min in all

  1. If threatened: do not pay, keep the messages, report it to the policeabout 30 minfreeLimits harm from: extortion
  2. Know the scam pattern: calls and texts that cite these leaked detailsabout 5 minfreeLimits harm from: scam calls, phishing messages
  3. Turn on instant transaction alertsabout 5 minHelps you notice: scam calls
  4. Remove your address and phone from public profiles and tighten SNS privacyabout 20 minfreeLimits harm from: visits or contact at home
  5. Use an authenticator app or passkey instead of SMS codesabout 20 minfreeLimits harm from: SMS code theft

What happened next27 events

  1. Undetected 2 eventsabout 361 days · show events
  2. Response 12 eventsNotice in 15 days · show events
  3. Remedy 2 eventsOngoing · show events
  4. Penalty 3 eventsOngoing · show events
  5. Disputes 8 eventsJudgment · show events
  1. Benesse Corporation and its group IT company ordered, jointly, to pay 3,300 yen to each successful plaintiff in five consolidated suits; other claims dismissed
  2. On remand, the Osaka High Court found a privacy infringement and ordered Benesse to pay 1,000 yen
  3. On appeal from a first-instance ruling that had found negligence but no compensable distress, the Tokyo High Court ordered Benesse Corporation and Synform, the company it had entrusted with managing the data, jointly to pay 2,000 yen to each of the two plaintiffs
  4. Group IT company held liable to 462 plaintiffs: 3,300 yen each · 3,000 yen solatium plus 300 yen legal fees; claim against Benesse dismissed
  5. Claim by about 180 customers dismissed: negligence found but no compensable distress · the 500 yen voucher was considered
22 more
  1. Supreme Court held the leak infringed the plaintiff's privacy and sent the damages claim back to the Osaka High Court
  2. On appeal the sentence was reduced to 2 years 6 months in prison and a 3 million yen fine
  3. The former contractor engineer was sentenced to 3 years 6 months in prison and a 3 million yen fine · Unfair Competition Prevention Act
  4. JIPDEC revoked Benesse's PrivacyMark certification, citing failures in contractor supervision and safeguards
  5. Submitted an improvement report to METI with a contractor-inclusive protection structure and security schedule
  6. Established an information security monitoring committee with outside experts
  7. METI recommendation under the Personal Information Protection Act: failure to supervise the contractor · Art. 22; urged thorough contractor supervision
  8. Published the summary of the external investigation committee's report: 216.39M gross records, about 35.04M after merging, about 48.58M people
  9. From mid-September, apology letters offered a 500 yen voucher · e-money gift or book card
  10. Set up a dedicated customer support division
  11. The vice chairman (representative director) and a director/CIO resigned over supervisory responsibility
  12. Q1 results booked a 26 billion yen extraordinary loss for investigation and security costs; forecast withdrawn
  13. Set aside a 20 billion yen fund for apologies to customers · gifts, fee reductions under consideration
  14. Filed a criminal complaint with the Tokyo Metropolitan Police; a contractor's former employee was arrested on 17 July
  15. From 12 July, letters of apology and explanation sent to customers whose data was confirmed leaked
  16. METI ordered Benesse to report under the Personal Information Protection Act · Art. 32
  17. Held a press conference on the leak
  18. Benesse confirmed the leak was its own and began work against suspicious solicitation; it asked businesses it judged likely to be using the data to stop
  19. Free-dial customer inquiry line opened after the 9 July press conference
  20. Reported the situation to METI and consulted it on next steps
  21. Customer inquiries led Benesse to suspect a leak; an emergency task force and internal investigation started
  22. Intrusion began
Company
Benesse Corporation
When it happened
–
Company detected it
Made public
Notice
Leak confirmed
Affected
35,040,000 records after merging duplicates · about 28.95M estimated actual records; about 48.58M people

How the facts developed

  1. About 35.04 million records sold to three list brokers (about 28.95 million estimated actual); email and expected delivery dates added for some services; no card data found sold
  2. First announcement: 7.6 million records confirmed leaked, up to 20.7 million possible; names, addresses, phone numbers, children's gender and dates of birth

Sources