Yamato Transport: 5.31 million records leaked; Nikkei newspaper reports 1.83 million, followed by unauthorised access at Times, which will immediately delete driver's licence images

Yamato Transport announced on the 16th that the number of records containing personal information leaked through unauthorised access had reached 5.31 million. The affected records belonged to some users of the Kuroneko Cash on Delivery Service, and covered the period from 1 October 2018 to 28 September this year. The leaked information included 5.26 million records containing names, addresses, telephone numbers and other details, of which approximately 490,000 also included email addresses. Approximately 50,000 records also included delivery destination information.

Nihon Keizai Shimbun announced on the same day that approximately 1.83 million records of personal information had been leaked through unauthorised access to its cloud service. The breakdown was approximately 150,000 records containing one or more of names, email addresses and addresses, and approximately 1.68 million records containing identifiers only. The information was released on the 7th. Authentication information was invalidated.

PARK24, which operates Times Car, announced on the 16th that it would delete, in stages by the end of this month, images of driver's licences and other identity verification documents in its possession. Because the data had been retained for 7 years after account cancellation, information on former users was also leaked. Approximately 6.6 million records of personal information were leaked at Times Car, including images of driver's licences and other documents in approximately 1.6 million records.

Separately, regarding information on a ransomware attack, Keio Electric Railway announced on the same day that an attacker claimed to have published information belonging to its group. Some external experts also believe that the international hacker group "Qilin" may have been involved.