NTT Data said on November 9 that unauthorized third-party access to a system it builds and runs for Sumitomo Life Insurance exposed the personal data of about 80,000 users, including people who used the services in the past.
The affected services are the Sumitomo Life Vitality trial and corporate edition, which can be used on its own, and Vitality Smart, including its employee-benefits type. Both are part of the Vitality health program.
The leaked data covers some combination of name, address, phone number, date of birth, email address and credit card number with some digits hidden. About 1,000 users had their card numbers exposed.
Insurance policy details, Vitality information tied to a policy and step-count data were not included.
Access cut off within a day
NTT Data confirmed the unauthorized access on the 2nd in the system used to take applications for the two services and reported it to Sumitomo Life the same day. It blocked outside access and suspended the services on the 3rd.
The company is still investigating the cause and the sequence of events.
According to Sumitomo Life, the suspension covers new applications for both services and the group management system for the employee-benefits type. That system handles cancellations and card changes by Vitality Smart users.
Use of the Vitality app and new applications and procedures for Vitality insurance are unaffected. NTT Data said it is putting the necessary security measures in place and checking that they work, and will decide on resuming the services once safety is confirmed.
Sumitomo Life said it had confirmed no misuse of the leaked information as of November 9. The two companies urged users to watch for suspicious calls and emails claiming to come from NTT Data or Sumitomo Life.
Sumitomo Life is working to identify the affected users and has set up a dedicated inquiry desk.