Customer information on about 45,000 people leaked from a company under GMO Internet Group that runs a service managing employee IDs for client firms, and files containing personal information could be obtained from outside for nearly nine years.
A near-decade window in which the files were reachable points to a failure of auditing and oversight rather than a single mistake by one engineer. The company has not explained how the exposure went unnoticed for that long.
A subsidiary flagged weaknesses in the system two years ago, and the president is due to hold a news conference. A suspicious website collecting information on GMO's victims may be connected to the hackers.
One victim who lost 40 million yen said they are "fighting fear the whole time." NHK reported that strong information linked to the attackers had been obtained, and that countermeasures are now the focus.