ENKR

NTT West group call-centre data theft

Add to my breach check

Made public · 9,280,000 people

What leaked7

Replaceable

  • Card number

Hard to replace

  • Mobile number
  • Home or delivery address

Permanent

  • Date of birth
  • Full name
  • Gender
  • Partial date of birth or age
  • Card number81 records from two client companies
  • Date of birthin some records · NTT West's own customers
  • Mobile numberphone number · landline or mobile
  • Genderin some records
  • Partial date of birth or ageage, in some records

To-dos3 · about 30 min in all

  1. Know the scam pattern: calls and texts that cite these leaked detailsabout 5 minfreeLimits harm from: scam calls, phishing messages
  2. Turn on instant transaction alertsabout 5 minHelps you notice: scam calls
  3. Remove your address and phone from public profiles and tighten SNS privacyabout 20 minfreeLimits harm from: visits or contact at home

What happened next25 events

  1. Undetected 2 eventsabout 10 yr 0 mo · show events
  2. Response 14 eventsNotice in 211 days · show events
  3. RemedyNone on record
  4. Penalty 6 eventsOngoing · show events
  5. Disputes 3 eventsOngoing · show events
  1. The contractor, NTT Marketing Act ProCX: no secondary harm, such as unauthorised use of customer information, confirmed so far
  2. PPC said it would file a criminal complaint against list broker Chuo Business Service for a false report to the commission
  3. PPC found that ProCX and NTT Business Solutions had made progress on the recommendation; the data had been sold to two list brokers, which received guidance
  4. The former temp worker was sentenced to 3 years' imprisonment suspended for 4 years and a JPY 1,000,000 fine; he reportedly sold data to list brokers about 250 times for about JPY 25 million
  5. PPC inspected the two list brokers that had bought the data · June 19, 2024 and 06-20
20 more
  1. The president and CEO stepped down at the end of March 2024, taking responsibility for the group company's leak of customer data
  2. Announced group-wide information-security measures based on the committee's findings
  3. Published the in-house investigation committee's report · with outside experts; the 2022 check had altered export logs and given the client false answers
  4. The former temp worker was indicted
  5. MIC gave NTT West written administrative guidance on supervising its contractors
  6. Began sending letters to people whose data could not be linked to a client
  7. Okayama police arrested the former temp worker
  8. PPC issued a recommendation (Art. 148) and guidance to ProCX and NTT Business Solutions over security-control failures, including the improper 2022 investigation report
  9. Count revised to 9.28 million customers of 69 clients; 1.17 million could not be linked to any client
  10. PPC ordered ProCX and NTT Business Solutions to report on the leak · Art. 146
  11. Opened an inquiry line for clients' customers
  12. Opened a dedicated call centre for NTT West customers
  13. Published an apology to customers
  14. NTT West announced that about 1.2 million of its own customers' records were among the stolen data
  15. ProCX and NTT Business Solutions announced that a former temp worker had taken about 9 million customer records of 59 clients
  16. After a police investigation of NTT Business Solutions, ProCX admitted the data theft and reported the leak to the client that had raised it
  17. Blocked writing data from maintenance terminals to USB memory
  18. A police search of NTT Business Solutions' offices made ProCX and NTT Business Solutions aware that customer data might have been taken
  19. After a client asked in April 2022 whether its customer data had leaked, ProCX and NTT Business Solutions told it in July 2022 that no leak was found
  20. Intrusion began
Company
NTT West
When it happened
–
Company detected it
Made public
Notice
Leak confirmed
Affected
9,280,000 people · customers and residents of 69 client companies and local governments; ProCX December 19, 2023, PPC: about 9.28 million

How the facts developed

  1. Revised to 9.28 million records of 69 clients; 1.17 million could not be linked to a client and were notified by letter from February 2024
  2. About 9 million records of 59 clients announced; NTT West's own customers about 1.2 million

Sources