Unauthorized access was confirmed on a distribution service for members of Tokyo Metro’s Metpo points program, and approximately 59,000 registered member email addresses may have been exposed. The access is believed to have originated outside Japan, and the company is investigating while working to identify the scope of the impact.
On 27 September, Tokyo Metro announced that the service for Metpo members may have been subject to unauthorized access and that approximately 59,000 email addresses may have been exposed. In investigating the related notice, the company determined that access had occurred from outside Japan.
The affected server contained email addresses registered by members whose messages could not be sent and whose subscriptions had therefore been suspended. The company explained that the server contained no member information other than email addresses. Countermeasures have been implemented.
The investigation into the scope and detailed cause of the impact is continuing, and the company plans to contact affected members by email. No instructions have been issued requiring separate procedures or access to an external website, and warnings have been issued about suspicious emails impersonating the company.
The company said it will disclose further developments and continue identifying the suspected point of intrusion and implementing thorough countermeasures.