ENKR

Benesse customer data leak

Add to my breach check

Made public · 35,040,000 records after merging duplicates

What leaked8

Hard to replace

  • Mobile number
  • Home or delivery address
  • Email address
  • Other profile data

Permanent

  • Health information
  • Date of birth
  • Full name
  • Gender
  • Health informationexpected delivery date, users of some services only
  • Mobile numberphone number · type not stated; fax number for registered users
  • Home or delivery addresspostal code and address
  • Email addressusers of some services only
  • Full nameregistered user and their child or guardian
  • Other profile datafamily relationship between registered user and child or guardian

To-dos5 · about 1 h 30 min in all

  1. If threatened: do not pay, keep the messages, report it to the policeabout 30 minfreeLimits harm from: extortion
  2. Know the scam pattern: calls and texts that cite these leaked detailsabout 5 minfreeLimits harm from: scam calls, phishing messages
  3. Turn on instant transaction alertsabout 5 minHelps you notice: scam calls
  4. Remove your address and phone from public profiles and tighten SNS privacyabout 20 minfreeLimits harm from: visits or contact at home
  5. Use an authenticator app or passkey instead of SMS codesabout 20 minfreeLimits harm from: SMS code theft

What happened next27 events

  1. Undetected 2 eventsabout 361 days · show events
  2. Response 12 eventsNotice in 15 days · show events
  3. Remedy 2 eventsOngoing · show events
  4. Penalty 3 eventsOngoing · show events
  5. Disputes 8 eventsJudgment · Back to latest

Disputes: 8 events

Back to latest
  1. Benesse Corporation and its group IT company ordered, jointly, to pay 3,300 yen to each successful plaintiff in five consolidated suits; other claims dismissed
  2. On remand, the Osaka High Court found a privacy infringement and ordered Benesse to pay 1,000 yen
  3. On appeal from a first-instance ruling that had found negligence but no compensable distress, the Tokyo High Court ordered Benesse Corporation and Synform, the company it had entrusted with managing the data, jointly to pay 2,000 yen to each of the two plaintiffs
  4. Group IT company held liable to 462 plaintiffs: 3,300 yen each · 3,000 yen solatium plus 300 yen legal fees; claim against Benesse dismissed
  5. Claim by about 180 customers dismissed: negligence found but no compensable distress · the 500 yen voucher was considered
3 more
  1. Supreme Court held the leak infringed the plaintiff's privacy and sent the damages claim back to the Osaka High Court
  2. On appeal the sentence was reduced to 2 years 6 months in prison and a 3 million yen fine
  3. The former contractor engineer was sentenced to 3 years 6 months in prison and a 3 million yen fine · Unfair Competition Prevention Act
Company
Benesse Corporation
When it happened
–
Company detected it
Made public
Notice
Leak confirmed
Affected
35,040,000 records after merging duplicates · about 28.95M estimated actual records; about 48.58M people

How the facts developed

  1. About 35.04 million records sold to three list brokers (about 28.95 million estimated actual); email and expected delivery dates added for some services; no card data found sold
  2. First announcement: 7.6 million records confirmed leaked, up to 20.7 million possible; names, addresses, phone numbers, children's gender and dates of birth

Sources