Asoview, which runs an online booking service for leisure facilities, said on the 3rd that more than 15 million pieces of personal information had leaked after a third party gained unauthorized access to a company it contracts to send email. The company is based in Shinagawa Ward, Tokyo.
The leaked data covers 15,821,184 email delivery records. It includes email addresses, member IDs, membership numbers, names, sex, dates of birth, registration dates, last login dates, phone numbers, postal codes, residential areas and usage information, along with ticket types, numbers of tickets purchased and numbers of participants.
No passwords or credit card information were exposed, Asoview said. The company said it has confirmed no damage so far from misuse of the leaked information.
Breach traced to Arara's mail service
Asoview said the leak stemmed from unauthorized access by a third party to Arara Message, the email delivery service it uses. Arara is the contractor in that chain.
The same breach has reached public systems. On the 3rd, Osaka city said the names and email addresses of users registered with its online administrative system may have leaked, and said the cause was the unauthorized access to Arara.
Other leaks at contracted mail vendors
Other organizations have reported leaks through the same kind of arrangement. Tokyo Metro said the email addresses of 80,000 customers leaked after unauthorized access to a company it contracts for email delivery.
A members-only site run by Kyodo News said information on up to 500 people leaked after unauthorized access to its email delivery contractor. MrMax said up to 1.73 million people's information leaked in unauthorized access, including email addresses and phone numbers.
Yakiniku King said the personal information of more than 10 million members, nearly its entire membership, leaked through unauthorized third-party access. TBS Shopping said the email addresses of 50,000 members leaked at a company it contracts for operations.