[ITmedia News] Up to 6.5 million pieces of personal information, including "Gin no Sara," feared to be leaked. App orders also suspended. Outsourced servers hit by ransom

On October 13, Ride On Express Holdings, which operates sushi delivery services such as Gin no Sara, announced that up to 6.5 million pieces of personal information registered on the official websites and apps of Gin no Sara, Kamatora, and Sushi Jodou may have been leaked. In a follow-up report on the suspension of the site and app announced on the 7th, it is said that the external server that stored registration information was attacked by a cyber attack.

Information that may have been leaked includes name, address, phone number, email address, gender, date of birth, password hash value, order history, and Deli Point member ID (member ID for the point service common to the three brands). This applies to users who have registered information on the official website or app in the past. Depending on the registration details, the names and birthdays of family members, as well as the name, address, and phone number of the recipient, may have been leaked.

Customers who order only through delivery restaurants, Uber Eats, or by phone are not eligible. Credit card information is also not included as it is not held by the company. As of the 13th, no clear traces of the information leak have been confirmed, and the fact and scope of the leak have not been determined.

According to the company, since October 5th, it has detected unauthorized access by a third party to its servers, and is investigating the attack route and whether there was any damage. In the early morning of the 7th, a system failure occurred on some servers. A server operating company reported that it had been attacked by ransomware, and the company shut down its systems. After that, the company received a report from the operating company that it was difficult to retrieve and restore the data that the company had been entrusted with storing.

An emergency response team was set up on the 7th, as registrant information for the official website and app was stored on the server. In addition to investigating whether there has been an information leak, we have begun considering measures to prevent secondary damage to users.

The company said it will report the incident to the Personal Information Protection Commission and the local police station, and will sequentially inform users who may be affected. At this time, we have not confirmed any secondary damage due to the unauthorized use of information, but we are urging people to be wary of suspicious calls and emails.

Orders from the official website and app continue to be suspended, and as of the 13th, there is no prospect of resumption. Orders are accepted by phone, in-store, at the delivery hall, and via Uber Eats.

At the same time, a ransomware attack caused a failure in IDCF Cloud provided by IDC Frontier. Starting around 3:40 a.m. on October 7, virtual servers stopped working in parts of East Japan Region 1, affecting 495 companies and local governments. IDC Frontier predicts that it will be difficult to retrieve and restore data stored in the target zone.

Ride-on Express Holdings has not disclosed the name of the company operating the affected server.