Nippon Kotsu announced that a July 11 unauthorized access incident may have resulted in the leakage of personal information affecting approximately 290,000 people. Applicants account for the largest group, and some My Number information may also be included.
In its sixth update, issued on 30 October, Nippon Kotsu reconfirmed the categories of affected individuals and the types of information that may have been leaked as a result of unauthorized access. The total, covering job applicants, crew members, employees including former employees, employees' family members, hire-car customers and business contacts, is approximately 290,000 people. The breakdown is approximately 107,900 applicants, approximately 72,000 parties involved in accidents and other incidents, approximately 60,100 crew members and staff, approximately 37,700 family members, approximately 13,100 customers and approximately 2,100 business partners.
The information that may have been leaked varies by category. For crew members and staff, it may include names, addresses, personnel information, salary payment information and health-checkup results. In some cases, driver's licenses, residence cards, facial photographs and bank account information may also be included, while My Number may be included in some tax and social security procedures. For applicants, educational and employment histories, as well as driver's license, facial photograph and bank account information, may have been leaked. For parties involved in accidents, the information includes names, addresses, dates of birth and insurance-procedure information, and may include details of injuries.
The company explained that not all items apply to everyone. Dispatch and ride information for taxi customers was not affected, and the company said it does not hold credit card information. Reports have been submitted to the police and the Personal Information Protection Commission, and notifications are being issued to affected individuals in stages. Measures to prevent recurrence include blocking the intrusion route, introducing multifactor authentication and strengthening monitoring. Going forward, the company will rebuild its reservation systems, review internal connections and strengthen security measures at contractors.