Leakage of Personal and Confidential Information
First written in FY2016. 2 of 4 entries say "Mitigated", first in FY2021. Latest entry: FY2026.
The whole theme swung hardest in 2026: 13 of 71 companies on the "Worse" side.
- FY2026WorsenedAnnual report
「In recent years, ransomware attacks have increased markedly across a wide range of industries, including domestic retail and distribution, and the threat environment surrounding information security has become more challenging than ever. In addition, the rapid spread of generative AI technologies has brought to light risks including sophisticated attack methods using generative AI and the unintended external leakage of confidential information.」
Information-leakage risks expanded to include ransomware, incidents through supply chains, attacks using generative AI and the leakage of confidential information. - FY2022MitigatedAnnual report
「The policies and rules in points ① and ② are continuously available for viewing on SmartDB, and training sessions are held for all employees from time to time. In addition, we have obtained ISO 27001 (ISMS) certification covering information security, including personal information, and maintain the certification through annual audits of our activities by an internationally accredited certification body.」
Specifies continuous access to the information-security and privacy rules, training sessions for all employees, and the maintenance of ISO 27001 certification as response measures. - FY2021MitigatedAnnual report
「Our group has established detailed information-security rules in its Information Security Policy, comprising the Basic Information Security Policy and Information Security Control Standards, and implements compliance measures and risk mitigation and response measures in the event of an incident. It has also established detailed rules relating to personal information in its Privacy Policy, comprising the Basic Policy on Personal Information and Basic Regulations for the Protection of Personal Information, and implements compliance measures and risk mitigation and response measures in the event of an incident. In addition, we have obtained ISO 27001 (ISMS) certification covering information security, including personal information, and maintain the certification through annual audits of our activities by an internationally accredited certification body.」
As measures to address information-leakage risks, specifically describes information-security and privacy policies, employee training and the maintenance of ISO 27001 certification. - FY2016First statedAnnual report
「If an information leak occurs in the future, our group’s reputation may decline, affecting its business performance and financial position.」
Risk arising from the handling of diverse customer information relating to points, credit cards, warranties, delivery and installation services, online shopping and other services.