Nojima said on November 2 that a third party had gained unauthorized access to the member management system behind its Nojima Online shopping site, exposing information on about 7 million members. The company detected and confirmed the breach on November 1, and confirmed the same day that personal data had leaked outside its systems.
The breach covers two sites: Nojima Online and the company's used smartphone buyback site. Both services are suspended.
The leaked data includes names in kanji and kana, login IDs, encrypted passwords, email addresses, home addresses, postal codes, phone numbers, dates of birth and gender. Members who have closed their accounts are not included.
Nojima has forced a reset of the login passwords on affected accounts and is directing members to set new ones. Neither site holds credit card information, the company said.
Response and reopening
Nojima said it has strengthened security measures and monitoring, including blocking outside access, and has consulted the police station with jurisdiction over the case. It has not decided when the sites will reopen and will announce a date once it has confirmed they are safe to use.
The disclosure follows a run of breaches at Japanese online services, several of them traced to contractors. Asobii reported the leak of 15.82 million members' records through a hacked email vendor, and Seven-Eleven Japan said more than 160,000 users of its 7NOW delivery service were affected through a delivery contractor.