Marui Group said on Monday that personal information on up to 9,086 people who applied for its digital bonds has leaked after unauthorized access to a server run by Securitize Japan, the contractor that handles administration of the bonds. The company said it had confirmed the leak.
The compromised data covers people who created accounts to apply for the bonds. It includes names, addresses, phone numbers, email addresses, dates of birth, gender and the number of investment units. Bank account numbers may have leaked for 54 of them. No credit card information was exposed.
Marui Group, based in Nakano Ward, Tokyo, said the damage came through the breach at Securitize Japan and that no leak from its own systems had been confirmed at this point. The company said it would work with the contractor to establish the cause and the scope of the impact, and would tighten its oversight of contracted work to prevent a repeat.
A cluster of contractor breaches
The disclosure adds to a run of incidents in which data held by outside contractors, rather than by the companies that collected it, has been exposed. In each case the affected business has said its own systems were not breached.
Marui Group did not say when the unauthorized access occurred or how it was detected. The company announced its findings on Monday.