World Co. Unit Tin Pan Alley Hit by Breach at RAGTAG, 1.2M Records

Japanese apparel company World announced on October 30 that a business server of its consolidated subsidiary Tin Pan Alley, which runs the secondhand designer fashion buying and selling service RAGTAG, was accessed without authorization. Some member information stored on the server may have leaked.

The company puts the affected volume at roughly 1.2 million records in total. The data includes names, addresses, phone numbers, dates of birth, genders and email addresses. World said it is still verifying exactly which members and how many records are involved.

According to the company, no leak of payment details such as credit card information has been confirmed, and no leak of facial data has been confirmed either.

Timeline of the intrusion

The intruder gained access to the Tin Pan Alley server at around 2:51 p.m. on October 17, breaking in and carrying out operations to extract data. Tin Pan Alley detected the suspicious activity at around 12:08 p.m. on October 28, roughly eleven days later, and isolated the server.

By 9:36 p.m. the same day, it had blocked the access route used in the attack and shut down part of the related internal business systems.

What comes next

World said it will ask outside security specialists to investigate. Based on their findings and advice, the company plans to put the necessary measures in place to prevent a recurrence.

The case adds to a run of large-scale personal data incidents at Japanese consumer retailers. Customers of RAGTAG should be alert to phishing emails, text messages or calls that exploit exposed contact details, since names, phone numbers and email addresses are among the data that may have been taken.