Investigation Results and Measures to Prevent Recurrence Regarding the Leakage of Personal Information Caused by Unauthorized Access at Our Consolidated Subsidiary
株式会社カインドオル (our consolidated subsidiary)
E-commerce platform
Theft of staff account credentials through phishing emails. In addition to the lack of two-factor authentication, the selection of authentication methods and account protection based on the assumption of phishing attacks, the design of permissions for bulk exports of customer information, and the monitoring framework for promptly identifying critical operations were inadequate.
Costs have been incurred for measures including operating a dedicated contact center, but the amount is Not disclosed. The impact on consolidated results is minor.
There is no change to the consolidated earnings forecast for the fiscal year ending February 2027.
Related procedures
Procedures toward submitting a final report to the Personal Information Protection Commission, consulting the police, and filing a victim report
Personal Information Protection Commission and police
Company response
Investigation by the subsidiary concerned. The investigation involved cross-checking phishing emails, employee PC logs, and access and operation histories provided by the operator of the e-commerce platform. A third-party committee and special investigation committee are Not disclosed.
Introduce two-factor authentication for all staff accounts using phishing-resistant passkeys／Conduct an account inventory／Limit permissions for bulk exports of customer information／Review procedures for verifying critical operations and escalating them internally／Develop an information security manual／Provide training, including anti-phishing exercises／Conduct regular inventories of access rights and establish a monitoring framework／Develop information security guidelines applicable to all group companies and appoint an information security officer at each group company／Revise the operating policy for the Cybersecurity Incident Response Team (CSIRT) and establish an operating and reporting framework covering all group companies／Establish an Information Security Liaison Council and, through regular meetings, develop a framework for continuously strengthening cybersecurity across the group／Regularly conduct inventories of account management, access rights, and authentication status for external tools used by all group companies
Measures to prevent recurrence will be advanced successively. Procedures toward filing a victim report will be advanced. The dedicated contact center will operate for the time being.
The Company will promptly announce any matters that require disclosure.
| Item | Details |
|---|---|
| Event name | Investigation Results and Measures to Prevent Recurrence Regarding the Leakage of Personal Information Caused by Unauthorized Access at Our Consolidated Subsidiary |
| Subject Entity | 株式会社カインドオル (our consolidated subsidiary) |
| Target Locations / Products | E-commerce platform |
| Cause | Theft of staff account credentials through phishing emails. In addition to the lack of two-factor authentication, the selection of authentication methods and account protection based on the assumption of phishing attacks, the design of permissions for bulk exports of customer information, and the monitoring framework for promptly identifying critical operations were inadequate. |
| Amount of Impact on Business Performance | Costs have been incurred for measures including operating a dedicated contact center, but the amount is Not disclosed. The impact on consolidated results is minor. |
| Impact on Earnings Forecast | There is no change to the consolidated earnings forecast for the fiscal year ending February 2027. |
| Type of litigation or proceeding | Procedures toward submitting a final report to the Personal Information Protection Commission, consulting the police, and filing a victim report |
| Court or authority | Personal Information Protection Commission and police |
| Investigation structure | Investigation by the subsidiary concerned. The investigation involved cross-checking phishing emails, employee PC logs, and access and operation histories provided by the operator of the e-commerce platform. A third-party committee and special investigation committee are Not disclosed. |
| Measures to prevent recurrence | Introduce two-factor authentication for all staff accounts using phishing-resistant passkeys／Conduct an account inventory／Limit permissions for bulk exports of customer information／Review procedures for verifying critical operations and escalating them internally／Develop an information security manual／Provide training, including anti-phishing exercises／Conduct regular inventories of access rights and establish a monitoring framework／Develop information security guidelines applicable to all group companies and appoint an information security officer at each group company／Revise the operating policy for the Cybersecurity Incident Response Team (CSIRT) and establish an operating and reporting framework covering all group companies／Establish an Information Security Liaison Council and, through regular meetings, develop a framework for continuously strengthening cybersecurity across the group／Regularly conduct inventories of account management, access rights, and authentication status for external tools used by all group companies |
| Outlook | Measures to prevent recurrence will be advanced successively. Procedures toward filing a victim report will be advanced. The dedicated contact center will operate for the time being. |
| Planned follow-up disclosure | The Company will promptly announce any matters that require disclosure. |
Items this document does not state (13)
These are items the company does not state in this document. We do not leave them blank, nor fill them in from other sources or by inference.
The reasons the company gives
The company's own explanation, not something inferred from the numbers.Staff account credentials were stolen through phishing emails, and two-factor authentication, authentication methods and account protection, the design of permissions for bulk exports, and the monitoring framework for critical operations were inadequate.