Yumirink, a Shibuya-based email-delivery vendor most of whose users' customers have never heard of, said on November 11 that a breach of its systems exposed 47,864,147 pieces of personal data, including email addresses — fallout that has reached JR Central and the operator of the @cosme cosmetics review site.
The company disclosed the unauthorized access on October 19. On October 26 it said up to about 51.62 million records might have leaked. It refined the figure after further investigation, ITmedia News reported.
The breach hit 49 systems running Cuenote FC, the company's email-delivery service. The leaked data includes 47,864,147 email addresses and 30,501,967 member IDs.
Names account for 6,665,055 records, gender for 2,059,658, dates of birth for 949,217, phone numbers for 412,794 and postal codes for 1,823,551.
Prefecture, address, hashed passwords, company names, school names and credentials for services run by customers were also exposed.
How the attackers got in
According to Yumirink, the attackers exploited a vulnerability in its systems and planted a malicious program on a server to reach the database. They also stole information indicating users' login status and posed as legitimate users to extract data through the administrative screen.
The company detected the unauthorized access on October 16. It then fixed the vulnerability and removed the malicious program.
In its October 26 disclosure, Yumirink said 190 items — including client company names, personal names, phone numbers and email addresses — in its Cuenote BASE customer-management system could be viewed from outside.
Services other than some Cuenote FC systems and Cuenote BASE are now operating normally, the company said.
Yumirink plans to introduce AI-based source-code reviews and a round-the-clock monitoring system to prevent a recurrence. It will publish the results again once an external specialist body completes a final investigation.
Downstream customers disclose their own leaks
The breach surfaced through the vendor's customers, several of which disclosed leaks from late October. The spread shows how far one supplier's security failure can travel.
Istyle, which runs the @cosme cosmetics review site, said on November 9 that customer data on about 2.8 million people had leaked.
JR Central and two other companies said on November 5 that member data on about 170,000 people had leaked through the Smart EX and Express Reservation shinkansen booking services.