ACCESS Says Taiwan Subsidiary Breach Leaked 1,305 Card Records
The breach also let attackers send 11,441 fraudulent emails using email service keys taken from the compromised server, and ACCESS says the recipient list was a separate list from the leaked personal data.
Reporting from 1 source: ASCII.jp.
ACCESS, listed on the Tokyo Stock Exchange Prime Market, said on October 15 that unauthorized access hit CROS, the e-commerce support service run by its Taiwan subsidiary ACCESS AP TAIWAN. The leak covered 155,280 customer IDs and 231,998 order IDs, with names, phone numbers, addresses and email addresses affected across Taiwan, Hong Kong, Macau and Singapore. Card data covered 1,305 accounts after duplicates were matched. Full card numbers, security codes and expiration dates leaked in 4 cases; the other 1,301 did not include security codes.
The card figures count orders where payment had not been completed, and ACCESS reached the 1,305 total after matching duplicate registrations. Only 4 of those cases exposed the full set of card number, security code and expiration date. The rest carried card information without the security code.
The company also tied the incident to 11,441 fraudulent emails sent with key information for an email sending service taken from the compromised server. ACCESS stated the recipient list behind those emails was a separate list from the leaked personal information, so the messages did not draw on the same customer records.
Synthesized by Yomimono from the 1 cited source below, including Japanese-language reporting where cited, then editorially reviewed before publishing.