Rohto Pharmaceutical Confirms Leak of 2.8 Million Customers' Data

Calls involving 9,715 people contain credit card numbers and expiration dates. According to the company, security codes and passwords were not included.

How the intrusion happened

Rohto said the provider of its mail-order phone system alerted it on September 10 to suspicious access. Working with external specialists, the company determined that a third party used the phone system's account credentials to break in, then used that system as a route to pull data from multiple customer management systems.

Response and outlook

The company is contacting affected customers by post and email. It is working with card companies to monitor for fraudulent use and has asked them to ensure that affected customers do not bear the cost of reissuing their cards.

As countermeasures, Rohto changed the passwords of all related accounts at once, stopped taking credit card numbers over the phone and switched to written payment procedures. It says no secondary damage linked to the leak has been confirmed so far.

For customers who ordered by phone, the case is a reminder to check card statements closely, since card numbers and expiry dates were exposed even though security codes were not.