MrMax Holdings Ltd.

A string of unauthorized access incidents targeting companies has led to personal data leaks, with GMO Research & AI, a subsidiary of GMO Internet Group, announcing that its survey site infoQ suffered unauthorized access and that the names, phone numbers and other data of 948,498 registered members were leaked. Some members were also confirmed to have suffered secondary harm, with a total of 2.86 million yen worth of points exchanged for Amazon gift codes, and the company said it will compensate the full amount. Mr. Max Holdings, which operates discount stores, also announced on the 6th that the phone numbers, email addresses and other data of up to 1,735,154 members of its store operating company's app and online store had been leaked. In addition, Daiwa Securities said the customer information of about 110,000 people may have been compromised, and Citizen Watch said the same for about 100,000 people, leaving affected companies scrambling to provide compensation and prevent recurrence. It has also been pointed out that the spread of artificial intelligence is casting a shadow as a background factor behind the surge.

Several companies in Japan, along with one university, have faced data leaks or cyberattacks since Monday, October 5, potentially affecting millions of customers, members, students and faculty combined. Osaka Metropolitan University disclosed that data on at least 130,000 students and faculty members may have leaked after about 500 servers were hit by suspected ransomware on Friday, October 2, leaving the student network system and faculty web portal still unusable and forcing classes to be cancelled. Meanwhile, MrMax Holdings disclosed that personal data on as many as 1.7 million customers may have leaked after a breach of the servers for its online trading system. GMO Research & AI said that as many as 948,500 member records were stolen, and that some member points worth about 2.9 million yen, or roughly 18,000 US dollars, were improperly exchanged for Amazon gift card codes. Monogatari, which operates more than 350 branches of the yakiniku restaurant chain King across Japan, reported that more than 10 million customer records, or nearly its entire registered user base, leaked from the system for its restaurant booking and loyalty points app. Daiwa Securities Group disclosed that data on about 110,000 customers of an affiliated brokerage may have leaked from servers managed by a contractor. All of the incidents were reported separately, and there is no indication so far that they are connected.

MrMax Holdings announced on the 6th that it had confirmed a third party gained unauthorized access to the servers for the MrMax app and online store operated by a group company, resulting in the leak of up to 1,735,154 members' information. The potentially leaked information includes app and online store member IDs, names, email addresses, and phone numbers, while addresses, dates of birth, credit card information, passwords, and purchase histories were not leaked. The company detected suspicious access to the MrMax servers on October 3, temporarily suspended services, and took measures to block external access. A subsequent investigation revealed that a third party had breached the servers and that some members' personal information had leaked.