SOURCENEXT: 22.51 Million Records — Reflections on the Communication Received After the News Broke (Bito Katsuyuki (尾藤克之)) - Expert

In October, multiple companies successively disclosed breaches involving personal information, with companies including ソースネクスト named among them. One view is that the clustering of the disclosures may reflect similar attacks occurring at multiple companies during the same period.

The dates on which unauthorized access was discovered and disclosed, as well as the period between the intrusion and its discovery, have been cited as the basis for the disclosures. ソースネクスト identified the unauthorized activity at around 9:00 on the 13th, reported it to the committee that same day, and disclosed it on the 15th. Notifications to members have also been sent progressively since that day.

Guidelines issued by the Personal Information Protection Commission state that a preliminary report on a data breach must be submitted to the commission within 3–5 days, followed by a final report and notification to the affected individuals within 60 days. The view presented is that a delay between discovery and disclosure is not, officially, a factor indicating that the incident was being “covered up,” while delays in discovering the breach are said to lead to questions from consumers.

The background to the timing of the disclosures is said to have been affected by the revised Act on the Protection of Personal Information, which took effect in April 2022, and a warning issued by JPCERT/CC on 8 October. The analysis presented is that similar attacks may have affected multiple companies during the same period.

Going forward, it is said to be necessary to check the three dates stated in disclosure documents issued by companies handling one’s member information: the date the intrusion began, the date it was discovered, and the date it was disclosed.