Sharefull, the operator of the spot-work app of the same name, said on November 9 that unauthorized access to an internal management system may have leaked personal data tied to as many as about 7.5 million user accounts, including bank details used for wage payments.
The company, based in Tokyo's Minato Ward, said the data potentially exposed includes names, phone numbers, email addresses, home addresses, dates of birth, bank account information for salary transfers, URLs pointing to stored facial photos, emergency contacts and information related to residence status. Bank account PINs and passwords were not included.
Corporate data on up to about 7,500 companies that post job listings on Sharefull may also have leaked. That covers company names, addresses, phone numbers, the names and email addresses of staff in charge, and some sales management data.
Sharefull said payroll and point-usage records, contract information, work data and images of identity verification documents were not affected. The company said it does not hold My Number identification numbers or credit card information.
Access blocked within hours
The unauthorized access occurred around 11:30 p.m. on November 4. Sharefull detected it around 9:45 a.m. the next day and cut off outside access by 2 p.m.
A subsequent investigation identified the scope of the impact and confirmed that no route leading to further data leaks remained, the company said.
Sharefull has reported the incident to police and is proceeding with notification to the Personal Information Protection Commission. It plans to investigate the cause with an outside specialist firm and to contact affected individuals in turn by email and other means.
The company urged users to watch for secondary harm from suspicious emails and text messages. The Sharefull service is operating as normal, and no unauthorized access has been confirmed to its related shift-management service Sharefull Shift.