Yamato, Estore and Nikkei report major data leaks in Japan

On Friday, Japanese parcel delivery giant Yamato Transport disclosed that its payment service system had been compromised, resulting in the unauthorized access of approximately 5.31 million customer data records. These records contained customer names and addresses but did not include sensitive information like credit card details or passwords.

The breach occurred due to an unauthorized access to Yamato Transport's payment service system. The company confirmed the incident on September 28 and promptly suspended the affected service, which was restored on October 9.

Estore Corp, an electronic commerce service provider for corporate clients in Japan, also revealed a significant data breach in its systems. The company disclosed that a breach discovered in August had exposed personal information of around 23 million individuals, including online shop operators and their customers. The leaked data included names, addresses, telephone numbers, and portions of credit card numbers.

However, the company reassured that no full credit card numbers were stored in the affected server, and thus, no financial damage has been reported so far.

Major daily publisher Nikkei Inc. reported another major data leak, with about 1.83 million personal data records exposed due to unauthorized access to its cloud service. The stolen information included names, telephone numbers, email addresses, and addresses, although 1.68 million of these records did not contain individual identification details.

The authentication credentials used to access the cloud service were stolen, and the system faced unauthorized access from early October 7 until the morning of October 8. No secondary damage was reported, and there was no suspension of Nikkei’s system.

Lastly, Yokohama-based nutritional supplements manufacturer Fancl Corp also confirmed an unauthorized access to its e-commerce website, leading to the exposure of approximately 390,000 personal data records. Additionally, Fancl's subsidiary Attenir Corp experienced a data breach with around 440,000 personal data records exposed. The leaked information from both companies included names, addresses, email addresses, phone numbers, and dates of birth, but it did not involve payment information such as credit card details.