Joshin Apologizes Over Possible Leak of 6 Million Records

What may have been exposed

The affected system is Joshin's member information database server. Beyond names and addresses, the company said the following may also have leaked: two images of driver's licenses, one set of My Number Card information and five bank account numbers.

Joshin, which is headquartered in Osaka, was hit by the unauthorized access around October. The cause of the intrusion is still under investigation.

A shift in data retention

As a preventive measure, Joshin plans to stop holding customer information it does not need. Takahashi said the incident had highlighted points the company should reflect on in how it keeps data, which points to a policy of holding as little unnecessary information as possible. Local media report that Joshin has already begun deleting data it no longer requires.

The case shows how large member databases at retailers can become a liability when old or unneeded records pile up. Identity documents and account numbers, even in small numbers, raise the risk of fraud for the people concerned.

Joshin has not yet said what caused the breach. The company's findings on how the intruder got in will determine what further safeguards it puts in place.