Central Japan Railway Company, known as JR Central, has announced a data breach affecting roughly 170,000 users of Smart EX, the online ticketing service for Shinkansen bullet trains. The company said the leaked information is limited to names, email addresses, member IDs or screen names, and membership types.
The breach traces back to a separate security incident at Yumirulink, a digital marketing and email forwarding service that routes some Smart EX messages. JR Central said the compromised data did not include dates of birth, home addresses, phone numbers, or credit card numbers and expiration dates.
Smart EX covers bookings for trains run by JR Central, JR West and JR Kyushu, a network that runs from Tokyo through Osaka, Kyoto and Hiroshima to Fukuoka and on to Kagoshima. The service also issues QR codes through its app in place of paper tickets.
Which emails were affected
JR Central said the breach was not connected to automatically generated emails such as booking confirmations or notices of customer-initiated schedule changes. It was linked instead to emails sent for purposes such as sale promotions or timetable change notifications following the Kumamoto earthquake.
The company said only the katakana renderings of users' names were leaked and that other forms were not compromised. It is unclear whether that covers kanji versions of Japanese names only, or also names written in the Latin alphabet. The Smart EX website carried a statement on the breach only on its Japanese-language page, with no mention on the English site.
Travelers who have booked Shinkansen seats through Smart EX may want to watch their other online accounts in the coming days.