The Chiba Kogyo Bank,Ltd. announced that 171,260 customer email addresses were exposed after unauthorized access to the external email delivery service, Arara. The exposure was limited to recipients of certain emails sent between 8 and 29 October, and did not include names, addresses or account numbers.
The Chiba Kogyo Bank,Ltd. announced that 171,260 customer email addresses were exposed to an external party as a result of unauthorized access by a third party to the external email delivery service provided by アララ株式会社. The affected data consisted of some recipients of emails sent by the bank between 8 and 29 October. The bank said its own systems had not been breached.
The exposed information consisted only of email addresses and did not include names, addresses, account numbers, PINs, passwords or credit card information. The bank said it would individually notify affected parties once the relevant addresses had been identified, and would not resume use of the service provided by its contractor until distribution had been suspended and its security confirmed.
The unauthorized access to the Arara Message email delivery platform provided by アララ株式会社 has also affected other contracted companies. アララ株式会社 has announced that, excluding overlaps between categories, a total of 81,329,467 records may have been exposed. The 170,000-plus records associated with The Chiba Kogyo Bank,Ltd. are being treated as the bank-specific impact resulting from this upstream service.
In response to the incident, financial institutions are expected to strengthen oversight and management, including minimising and managing customer data held by contractors' delivery platforms and confirming whether notification logs can be obtained. The bank said it would continue to suspend use of the contractor's service and decide whether to resume it once its safety had been confirmed.