ENKR

Benesse customer data leak

Add to my breach check

Made public · 35,040,000 records after merging duplicates

What leaked8

Hard to replace

  • Mobile number
  • Home or delivery address
  • Email address
  • Other profile data

Permanent

  • Health information
  • Date of birth
  • Full name
  • Gender
  • Health informationexpected delivery date, users of some services only
  • Mobile numberphone number · type not stated; fax number for registered users
  • Home or delivery addresspostal code and address
  • Email addressusers of some services only
  • Full nameregistered user and their child or guardian
  • Other profile datafamily relationship between registered user and child or guardian

To-dos5 · about 1 h 30 min in all

  1. If threatened: do not pay, keep the messages, report it to the policeabout 30 minfreeLimits harm from: extortion
  2. Know the scam pattern: calls and texts that cite these leaked detailsabout 5 minfreeLimits harm from: scam calls, phishing messages
  3. Turn on instant transaction alertsabout 5 minHelps you notice: scam calls
  4. Remove your address and phone from public profiles and tighten SNS privacyabout 20 minfreeLimits harm from: visits or contact at home
  5. Use an authenticator app or passkey instead of SMS codesabout 20 minfreeLimits harm from: SMS code theft

What happened next27 events

  1. Undetected 2 eventsabout 361 days · show events
  2. Response 12 eventsNotice in 15 days · Back to latest
  3. Remedy 2 eventsOngoing · show events
  4. Penalty 3 eventsOngoing · show events
  5. Disputes 8 eventsJudgment · show events

Response: 12 events

Back to latest
  1. Submitted an improvement report to METI with a contractor-inclusive protection structure and security schedule
  2. Established an information security monitoring committee with outside experts
  3. Published the summary of the external investigation committee's report: 216.39M gross records, about 35.04M after merging, about 48.58M people
  4. Set up a dedicated customer support division
  5. The vice chairman (representative director) and a director/CIO resigned over supervisory responsibility
7 more
  1. Q1 results booked a 26 billion yen extraordinary loss for investigation and security costs; forecast withdrawn
  2. Filed a criminal complaint with the Tokyo Metropolitan Police; a contractor's former employee was arrested on 17 July
  3. From 12 July, letters of apology and explanation sent to customers whose data was confirmed leaked
  4. Held a press conference on the leak
  5. Benesse confirmed the leak was its own and began work against suspicious solicitation; it asked businesses it judged likely to be using the data to stop
  6. Free-dial customer inquiry line opened after the 9 July press conference
  7. Reported the situation to METI and consulted it on next steps
Company
Benesse Corporation
When it happened
–
Company detected it
Made public
Notice
Leak confirmed
Affected
35,040,000 records after merging duplicates · about 28.95M estimated actual records; about 48.58M people

How the facts developed

  1. About 35.04 million records sold to three list brokers (about 28.95 million estimated actual); email and expected delivery dates added for some services; no card data found sold
  2. First announcement: 7.6 million records confirmed leaked, up to 20.7 million possible; names, addresses, phone numbers, children's gender and dates of birth

Sources