Since the end of September, Japanese companies have issued a series of announcements about unauthorized access and information leaks, including the serious incident involving the leak of driver's license images from Times Car Share. Experts say it is difficult to determine whether the attacks are connected, while pointing to efforts to maximise the value of personal information.
Since the end of September, Japanese companies have issued a series of announcements about unauthorized access and information leaks, with prominent services targeted in incidents including the leak of driver's license images from Times Car Share and the leak of more than 10 million records from Yakiniku King. Many consumers are believed to suspect that they may have been affected.
Hiroaki Kuramochi (倉持 浩明), Director, Senior Executive Officer and CTO of ラック, noted that the publicly available information alone is insufficient to determine whether the series of incidents involved the same attacker or a single campaign. At the same time, he expressed the view that a common structure exists in which large volumes of personal information are accumulated in consumer-facing web services and shared SaaS platforms, with the aim of increasing their value to criminals.
The stated recognition is that the key common feature of the attacks is not a specific attacker, but the drive to maximise the criminal value of personal information and the efficiency of compromising it. Information that is difficult to change, such as identity data, together with recent activity data and authentication credentials, is considered particularly likely to be targeted.