[ITmedia News] Hankyu Hanshin Department Store, etc.'s common ID, almost all members' information leaked, about 1.26 million cases, unauthorized access to reservation site

H2O Retailing (Kita-ku, Osaka) announced on October 19 that the Hankyu Department Store/Hanshin Department Store reservation site operated by its subsidiary Hankyu Hanshin Department Store had been accessed illegally by a third party, and some of the approximately 1.26 million pieces of personal information related to the group companies' common member ID "H2O ID" had been leaked. As of the same day, no unauthorized use of the leaked information or secondary damage had been confirmed.

On the 16th, we confirmed unauthorized access to our customer management system via the reservation site, and on the same day, we blocked unauthorized communications from outside and shut down the entire reservation site system. On the 17th, unauthorized access was also confirmed on mail order sites ``HANKYU HANSHIN E-STORES'' and ``Remo Order,'' and both sites were suspended. A subsequent investigation revealed the leak on the 19th.

A portion of the personal information of almost all H2O ID members was leaked via the reservation site. Items include ID, name, gender, email address, postal code, address, phone number (including mobile phone), age, date of birth, and services used with the ID.

We are currently investigating whether there is a leak from E-STORES and Remo Order. Both services maintain product order history, credit card type, last four digits, name, expiration date, point card type, last four digits, and address book information. The company says it does not retain all digits of card numbers and security codes, and there is no risk of unauthorized use. We have not confirmed any leakage of login passwords.

H2O Retailing has reported the incident to the Personal Information Protection Commission and the local police station, and is contacting H2O ID members via email. After investigating the cause and fixing the vulnerability, we plan to resume service as soon as it is safe to do so. Members were advised to be careful as they may receive suspicious communications pretending to be from the company to their registered email addresses or phone numbers.