Bookoff, JR East each report 6 mil customer records leak in newest breach

Japanese second-hand goods retailer Bookoff Group Holdings Ltd. and East Japan Railway Co. disclosed on Friday that over 6 million customer records were exposed due to unauthorized access to their servers. Bookoff reported that up to 6.43 million accounts were affected after a member data management system at one of its subsidiaries was breached, while JR East stated that around 6.09 million accounts were compromised.

The stolen data included personal details such as names, birthdays, addresses, email addresses, membership numbers, and reward program identification numbers. However, payment information like credit card numbers was not stolen, as the affected system did not store such details. Bookoff confirmed unauthorized access on Tuesday, promising to enhance its security framework to prevent future breaches.

JR East, on the other hand, revealed that email addresses of 4.03 million accounts at its credit card service Viewcard Co. were exposed, along with email logs for 1.67 million accounts from its Ekinet service and email addresses, credit card expiration dates, and birthdays for 390,000 members of its Otona no kyujitsu kurabu program.

The railway assured that no payment information was leaked. In a series of recent data breaches, dozens of Japanese companies have fallen victim to unauthorized access in recent days, prompting the government to advise businesses to strengthen security measures. Other affected firms include car-sharing service Times Car, which disclosed 6.6 million exposed accounts containing 1.6 million driver's license images; convenience store operator Lawson Inc.; karaoke venue operator Daiichikosho Co.; and travel agency H.I.S. Co., which notified the public in February about a potential passport data breach.