ENKR

Joshin network breach, possible member data leak

Add to my breach check

Made public · about 6 million records at most

What leaked9

Replaceable

  • Password

Hard to replace

  • ID card image
  • Bank account number
  • Mobile number
  • Home or delivery address
  • Other profile data
  • Username

Permanent

  • Purchase or order history
  • Full name
  • ID card imagedriver's licence images: 2; My Number card: 1 · renovation photo upload system
  • Passwordinitial password of the subscription login; how it was stored is not stated
  • Bank account number5 account numbers · renovation photo upload system
  • Mobile numberphone number · type not stated
  • Home or delivery addressmember database
  • Purchase or order historysubscription billing history
  • Full namemember database
  • Other profile datamember number; subscription contract number, device ID, activation code and handwritten signature; renovation work photos
  • Usernamesubscription login ID

To-dos6 · about 1 h 30 min in all

  1. Change the leaked password everywhere you reused itabout 30 minfreeStops: account takeover
  2. Know the scam pattern: calls and texts that cite these leaked detailsabout 5 minfreeLimits harm from: scam calls, phishing messages
  3. Turn on instant transaction alertsabout 5 minHelps you notice: scam calls
  4. Turn on two-step sign-in for email and bankingabout 15 minfreeLimits harm from: account takeover
  5. Use an authenticator app or passkey instead of SMS codesabout 20 minfreeLimits harm from: account takeover
  6. Remove your address and phone from public profiles and tighten SNS privacyabout 20 minfreeLimits harm from: visits or contact at home

What happened next12 events

  1. UndetectedNone on record
  2. Response 12 eventsNotice in 10 days · show events
  3. RemedyNone on record
  4. PenaltyNone on record
  5. DisputesNone on record
  1. Decided to stop keeping customer data it does not need
  2. The president apologised at the interim results briefing
  3. By the second notice, was contacting each customer whose ID image or account number was in the renovation photo upload system
  4. Second notice: up to about 6 million member records and records in two other systems may have leaked
  5. By the second notice, had consulted and reported to the police
7 more
  1. Disclosed the same notice to the Tokyo Stock Exchange
  2. Apologised in the notice
  3. Sent a first report to the Personal Information Protection Commission by the first notice
  4. First notice: a personal data leak cannot be ruled out
  5. Some services unavailable as a result of the measures
  6. By the first notice, restricted access from outside after it became aware of the access
  7. Detected an anomaly on its network and found traces of unauthorised access
Company
Joshin
Company detected it
Made public
Notice
Possible leak
Affected
about 6 million records at most (approx.) in the member database; up to about 230,000 more in the Joshin subscription system and up to about 800 in a renovation photo upload system · possible leak; company notice

Sources