BOOKOFF membership-system breach affects 6,383,279 people; official notice asks users to change passwords

In its third report on 6 November, BOOKOFF Group Holdings restated that membership data at subsidiary BOOKOFF Corporation was taken from outside between 4 and 6 October, that the path was blocked after confirmation on 6 October, and that the scope was unchanged from the corrected second report ^[1]. It confirmed 6,427,735 membership-number records and 6,383,279 people (6,170,908 active and 212,371 former members), covering names, dates of birth, sex, occupation, nicknames, email addresses, phone numbers, registered addresses, password hashes, point-card and membership numbers for app, online-store and web members; it said payment and bank-account data, in-store ID documents, home-pickup ID images and separately entered delivery addresses were out of scope, as were customers who only use a physical membership card ^[1]. It asked affected members to change their official online-store and official-app passwords on the official app or website, to change the same or similar passwords used elsewhere, not to follow a password-reset link in a notification email (the company said it would not include one), and to ignore impersonating messages because it will not ask for passwords, card or bank details by email, SMS or phone ^[1].

Industries mainly affected: Retail