八十二長野銀行 announced that an employee's email account had been accessed without authorization. It identified 34 individuals, 627 corporate clients and 11 other related organizations as potentially affected, and said that no leakage of account information or PINs had been confirmed.
The bank said that an employee's email account was accessed without authorization on 7 October after the employee received a phishing email posing as a foreign company. It subsequently found that some electronic mail information in the account may have been leaked to a third party.
The investigation identified the potentially affected scope as 34 individuals, 627 corporate clients and 11 other related organizations. The bank said that, at this time, it had received no reports of damage caused by unauthorized use.
The bank has completed notifications to at least 33 companies whose emails were viewed, while notifications to 531 companies are in progress. Transaction-related information may be included for 96 of the corporate clients.
The incident shows that even unauthorized access to a single employee's email account can potentially affect information on numerous business partners, depending on the scope of the access. From the standpoint of preventing recurrence, detection of anomalous logs and a review of authentication procedures are required.