A breach at Japanese email delivery company Arara has exposed email addresses that residents entered when booking pickup of their My Number Card, Japan’s national ID card, with cities across the country disclosing counts this week.
The addresses were held by Arara Message, a service that software company TKC uses to send confirmations from its My Number Card issuance booking and management system. TKC said up to 2,230,812 addresses belonging to customers of its systems leaked. Arara’s investigation found that only email addresses were taken from that environment, not message text, My Number data or municipal application information, TKC said. It is still working out which customers and systems were affected.
Cities have begun reporting their own figures: up to 53,294 addresses in Tsu, up to 21,383 in Isahaya, 6,629 in Suzuka, including duplicates, 6,331 in Ise, up to 5,465 in Hanamaki and up to 3,198 in Ueda. Naka said the booking system itself was not accessed and that it has not yet confirmed whether its own users were affected. Tsu has stopped sending the messages and Ise has switched from automatic notices to manual ones. Tsu said card issuance is unaffected.
Arara’s own report describes a much wider incident. An attacker broke into a server for the service and moved through many others between October 28 and 31, taking database contents from 97 servers used by up to about 380 contracting companies. About 77 million email addresses were taken or may have been, a count Arara says is still being checked and does not represent the number of people. Depending on the client, the data can include names, gender, birth dates, phone numbers, member numbers and street addresses. Arara says its services hold no credit card numbers.
The company finished halting Arara Message on October 31 and has not set a date to resume it. It also said the attacker used the service to send up to about 7.13 million fraudulent messages posing as credit card companies between October 28 and 30. Arara reported the incident to Japan’s Personal Information Protection Commission and to police on October 29.
Other customers are also disclosing exposure. Sumitomo Mitsui Banking Corporation said 227,216 addresses used for its mailings, mainly to corporate customers, leaked, and that account numbers, balances and PINs were not included. Naka told residents to delete suspicious messages without opening their links or attachments.
Sources: Arara, TKC, Naka City, Chunichi Shimbun, NBC Nagasaki Broadcasting, Ise Shimbun, Iwate Nippo, Shinano Mainichi Shimbun, Business+IT
–
By the ID Tech Editorial Team
