Credit card numbers may have leaked in cyberattack on Japan’s Muji

TOKYO – Muji brand operator Ryohin Keikaku said on Nov 4 that about 1.09 million customer records, including credit card numbers, may have been leaked following unauthorised access to its system.About 345,000 of the potentially leaked Muji Card customer records contain full numbers of currently valid credit cards and dates of birth, the Japanese operator said.Late in October, the company also reported that up to 27.26 million customer records may have leaked following unauthorised access to its Muji App.Earlier on Nov 4, Nomura Investor Relations, a subsidiary of Nomura Holdings, said a system providing information services to institutional investors and analysts had been subject to unauthorised access, resulting in a data breach.The firm’s announcement came after major electronics retailer Bic Camera said on Nov 2 it may also have been affected by the latest string of data leaks. It said about 14.9 million customer records, including e-mail addresses, may have leaked due to unauthorised access to the system of a contractor handling its e-mail newsletter distribution.Nomura Investor Relations has not disclosed the number of records affected but said the leaked information may include personal data such as names and e-mail addresses. It has suspended the service and is investigating the extent of the impact.The affected service is Institutional Navi, which provides information on corporate earnings briefings and supports attendance management. Unauthorised access was detected on Nov 2, and the data breach was confirmed the following day.Nomura Investor Relations said it has also suspended an information service for individual investors that uses the same server, as a precautionary measure, and is investigating whether it had also been subject to unauthorised access.Meanwhile, Bic Camera said the compromised e-mail distribution system was run by Arara. No credit card information or online shopping login credentials were included, it said.Affected data possibly consists of customer information from Bic Camera and its subsidiaries, Kojima and Sofmap. Bic Camera said it is investigating the extent of the impact but that no secondary damage has been confirmed so far.Japanese regional airlines Airdo and Solaseed Air were also affected by data breaches stemming from unauthorised access to e-mail distributor Arara’s system.Airdo, headquartered in Sapporo on Japan’s northernmost main island of Hokkaido, said on Nov 4 that 673,920 e-mail user records had been leaked, while Solaseed Air, based in Miyazaki on the south-western main island of Kyushu, said up to 490,000 e-mail addresses had been leaked.Both airlines said credit card information and names were not compromised.Workwear producer Workman, another client of Arara’s e-mail distribution service, said up to 1.45 million e-mail addresses may have leaked. KYODO NEWS