Qoo10 data breach: addresses, geo-coordinates and body traits

What data was affected in the Qoo10 breach?

The company says the following may be involved: name, nickname, email address, phone number, date of birth, gender, profile information, home and delivery addresses, the geographic coordinates of those addresses, customer segment information, physical characteristics entered voluntarily, account identifiers, IP address, personal notes and on-site point balance.

The source does not mention payment card numbers in the list. The company has not said how many accounts are actually affected, and the wording is "may include", so not every item applies to every user.

What has Qoo10 done about it?

eBay Japan says it blocked the access as soon as it was detected. It then invalidated all authentication tokens that might have been issued or used illegally. Tokens are the digital passes that keep you logged in without asking for your password each time. Accounts that may have been affected were forcibly logged out.

A detailed investigation is still under way.

What it means for users

Coordinates and self-described physical traits are unusual items to see in a leak, because they pin down where a person lives and say something personal about them. Combined with a phone number and email address, that is useful material for convincing phishing messages. Anyone with a Qoo10 account should treat unexpected emails or texts that mention their orders or details with suspicion.

The case adds to a run of recent Japanese incidents, including a breach at an email delivery firm and a card data leak at an electronics retailer.