H2O Retailing says data of about 1.26 million H2O ID records leaked in site breaches
In short
H2O Retailing said on 19 October that unauthorized access to three sites run by its subsidiary Hankyu Hanshin Department Stores leaked personal information of about 1.26 million records tied to the "H2O ID" membership. The company said nearly all H2O ID members are affected and that no misuse or secondary damage has been confirmed so far. All three sites have been suspended.
Read the full story 2 min read
H2O Retailing said on 19 October that three sites operated by its subsidiary Hankyu Hanshin Department Stores had been accessed without authorization by a third party. The sites are the Hankyu and Hanshin department store reservation site, HANKYU HANSHIN E-STORES and Remo Order. The company said about 1.26 million records of personal information linked to the "H2O ID" were leaked, which it said covers nearly all H2O ID members. [ 1 , 3 , 4 , 5 , 6 , 9 , 14 ]
According to the company, unauthorized access to its customer management system via the reservation site was confirmed on 16 October. Sankei Shimbun and ITmedia reported that the company blocked improper external communication the same day and shut down the whole system of the reservation site. Access to HANKYU HANSHIN E-STORES and Remo Order was confirmed on 17 October, and those two sites were also suspended. Nikkei described the reservation site as one for booking events inside department stores. [ 1 , 4 , 5 , 6 , 14 ]
ASCII.jp and ITmedia described the H2O ID as a member ID that can be used across target services of the H2O group. The items listed as leaked include the ID, name, gender, email address, postal code, address, mobile and other phone numbers, age, date of birth and the services used under the ID. Outlets word the figure differently. ASCII.jp, Nikkei and ITmedia say part of the roughly 1.26 million records leaked, while Yomiuri says personal information of about 1.26 million members leaked. [ 2 , 5 , 6 , 7 , 14 ]
For HANKYU HANSHIN E-STORES and Remo Order, the company said it is still investigating whether anything leaked. ITmedia reported that the two services hold order history, card type, last four digits, name and expiry date of credit cards, point card information and address book information. TBS reported that some of the credit card information may have been leaked. Nikkei and ITmedia reported that the sites do not hold full card numbers or security codes, so the company sees no risk of card misuse. ITmedia added that a leak of login passwords has not been confirmed. [ 1 , 2 , 4 , 5 , 6 , 14 ]
The company said no misuse or secondary damage has been confirmed at this point. Sankei and ITmedia reported that it has notified the Personal Information Protection Commission and police. Nikkei and ITmedia reported that affected customers are being contacted by email in turn. The company plans to resume the services once the cause is investigated, vulnerabilities are fixed and safety is confirmed. [ 1 , 5 , 6 , 14 ]
The company apologised for causing great worry and inconvenience and warned that suspicious emails, text messages or calls posing as the company may reach registered email addresses and phone numbers. Nippon TV and Asahi reported dedicated help lines open from 10:00 to 20:00. [ 2 , 3 , 4 , 5 , 8 , 14 ]
Why it matters
The company said nearly all H2O ID members are affected, and it warned that suspicious emails, texts or calls posing as the company may reach registered addresses and phone numbers. Whether data from two online shopping sites, including partial card information, was also taken is still under investigation.
Key facts
- H2O Retailing announced on 19 October that three sites run by its subsidiary Hankyu Hanshin Department Stores were accessed without authorization: the Hankyu and Hanshin department store reservation site, HANKYU HANSHIN E-STORES and Remo Order. [ 1 , 3 , 4 , 5 , 6 , 14 ]
- About 1.26 million records of personal information linked to the "H2O ID" were leaked, which the company said covers nearly all H2O ID members. [ 1 , 4 , 8 , 9 , 14 ]
- Access to the customer management system via the reservation site was confirmed on 16 October; unauthorized access to HANKYU HANSHIN E-STORES and Remo Order was confirmed on 17 October. [ 1 , 4 , 5 , 14 ]
- The leaked items include H2O ID, name, gender, email address, postal code, address, phone numbers, age, date of birth and the services used under the ID. [ 5 , 14 ]
- The company said no misuse or secondary damage has been confirmed so far. [ 1 , 5 , 6 , 7 , 14 ]
- The company reported the incident to the Personal Information Protection Commission and to police, and is contacting affected customers by email. [ 1 , 6 , 14 ]
Confirmed by several sources
- H2O Retailing announced on 19 October that three sites run by Hankyu Hanshin Department Stores suffered unauthorized access by a third party. [ 1 , 3 , 4 , 5 , 6 , 14 ]
- About 1.26 million records of personal information, covering nearly all H2O ID members, were reported as leaked. [ 1 , 4 , 8 , 9 , 14 ]
- The company has not confirmed any misuse or secondary damage as of the announcement. [ 1 , 5 , 6 , 7 , 14 ]
- The affected sites have been suspended, and the company plans to resume services once safety is confirmed. [ 1 , 4 , 5 , 6 , 14 ]
Still unclear
- Whether data was leaked from HANKYU HANSHIN E-STORES and Remo Order. The company said the presence or absence of a leak from these two sites is still under investigation.
- Whether credit card information was leaked. TBS listed card type, last four digits, name and expiry date as possibly leaked, while Nikkei and ITmedia said the sites hold no full card numbers or security codes and the company sees no risk of card misuse. The company said it is investigating.
- How the 1.26 million figure should be read. Outlets differ: some say about 1.26 million records leaked, some say a part of about 1.26 million records leaked, and Yomiuri says about 1.26 million members' information leaked.
- The cause of the intrusion. The company said it is investigating the cause and fixing vulnerabilities; the documents give no cause.
- The company reported to the Personal Information Protection Commission and police. Reported by a single source so far
What local media are saying
Timeline, local time
- Sankei Shimbun reports that H2O Retailing announced the leak on 19 October. [ 1 ]
- Nippon TV reports that three sites were accessed without authorization and about 1.26 million records may have leaked. [ 4 ]
- Yomiuri Shimbun reports the leak of members' names, dates of birth, email addresses, addresses and mobile numbers. [ 7 ]
- ITmedia reports the full timeline, the list of leaked items and the company's reports to the regulator and police. [ 14 ]