NHK reported that Sagawa Express said the personal information that may have leaked externally in the unauthorized access could include names, addresses, telephone numbers and more, up to 53.23 million records. According to ITmedia NEWS, this was the fifth report on the unauthorized access to the “Package Inquiry Service” announced on September 30, and the package tracking service was also resumed the same day. TBS NEWS DIG reported that the data concerned is the names and addresses of senders and recipients written on shipping labels. Asahi Shimbun described it as “up to a cumulative 53.23 million records.” According to ScanNetSecurity, the number was described as under investigation in the fourth report on October 9. ITmedia NEWS notes that the possible leak of personal information had been announced on October 1.
Because a shipping label carries the name, address and telephone number of both sender and recipient, one parcel means the contact details of two people. As the word “cumulative” in Asahi Shimbun’s phrasing indicates, the number is a cumulative count and does not match the number of people actually affected. With the number now fixed, it appears likely that client businesses and local governments will go on to disclose the effect on their own users.
People who sent or received parcels during the period covered may have their own name, address and telephone number included. Even if suspicious emails or text messages claiming to be from the sender or a delivery company arrive, there is room to check against official notices before opening any link.
A view that takes the scale seriously. NHK reported that names, addresses and telephone numbers could number up to 53.23 million records, and Asahi Shimbun reported it as a cumulative count. The papers’ headlines put up front that a large volume of information including contact details may have gone outside.
A view that stresses this is still the stage of a “possible” leak. ITmedia NEWS says only that the number became known in the fifth report and does not touch on any damage from misuse. Given that the number was still under investigation through the fourth report, the picture is that the whole is still being investigated.
What can be confirmed is that a number of up to about 53.23 million records was given on the 23rd and that the tracking service was resumed. What cannot be confirmed is whether there have been cases of the information actually being misused, and the details of the intrusion route. Today we want to watch whether follow-up from Sagawa Express, notices to those affected, and announcements from client businesses continue.
NHK (up to 53.23 million records, 10/23) · ITmedia NEWS (fifth report and tracking resumed, 10/23) · TBS NEWS DIG (names and addresses on shipping labels, 10/23) · Asahi Shimbun (cumulative 53.23 million, 10/23) · ScanNetSecurity (as of the fourth report, 10/19)
Sagawa Express: Up to 53.23 Million Records of Personal Data May Have Leaked in Unauthorized Access to Its Package Inquiry Service
On the 23rd, Sagawa Express disclosed that the personal information that may have leaked externally in the unauthorized access runs to as many as about 53.23 million records.
NHK reported that the personal information that Sagawa Express, the major courier, had said might have leaked externally after unauthorized access could cover as many as 53.23 million records, including names, addresses and telephone numbers. According to ITmedia NEWS, Sagawa Express issued its fifth report on the 23rd on the unauthorized access to its “Package Inquiry Service,” announced on September 30, and the number of affected records was established in that report. The package tracking service, which had been suspended, was also resumed the same day, it said. TBS NEWS DIG reported that the information that may have leaked is the names and addresses of senders and recipients written on shipping labels.
Asahi Shimbun described the personal information that may have leaked as “a cumulative count of up to 53.23 million records.” ITmedia NEWS notes that Sagawa Express announced the possible leak of personal information on October 1. According to ScanNetSecurity, as of the fourth report on October 9, the number and scope of the affected records were described as under investigation. With this fifth report, a number was given for the first time. Whether the information has actually been misused and caused damage has not been confirmed in the reporting.