A contractor of NTT DATA was subject to unauthorized access, resulting in the leakage of personal information belonging to at least 2,789 people. The leaked data included information on corporate bond purchasers, and multiple securities companies were using the service.
NTT DATA announced that it had confirmed a data breach after unauthorized access by a third party occurred on a service provided by the Japanese subsidiary of US-based Securitize, one of its contractors. The breach involved the personal information of at least 2,789 people.
The leaked data included kana-form names, purchase quantities and email addresses of 2,678 purchasers of Kintetsu Group Holdings corporate bonds, as well as the names, addresses, telephone numbers, email addresses, genders and dates of birth of 111 purchasers in total of corporate bonds issued by West Japan Railway Company and Kagome.
Multiple securities companies, including Rakuten Securities, Nomura Securities, Mitsubishi UFJ Morgan Stanley Securities and SBI Securities, were involved in the service. It is also possible that the names and email addresses of systems personnel at corporate bond issuers and financial institutions were obtained without authorization.
NTT DATA is continuing its investigation in cooperation with Securitize's Japanese subsidiary, and the corporate bond benefits service is currently suspended. The company said it plans to review its contractor's security measures and its management of contractors.