Intruders reach Hankyu Hanshin Department Stores' customer system via its booking site, exposing names, addresses, phone numbers and birth dates of nearly all of about 1.26 million H2O ID members

Japan's H2O Retailing and its subsidiary Hankyu Hanshin Department Stores said on October 19 that a third party gained unauthorized access to the customer management system via the department stores' booking site on October 16, and that unauthorized access was also found the next day on the official shopping site HANKYU HANSHIN E-STORES and on Remo Order, after which the company shut the sites down ^[1]. The company says part of the personal data of nearly all of about 1.26 million H2O ID members leaked, including names, gender, email addresses, postal codes, addresses, mobile and landline numbers, age and date of birth; its October 30 second report also confirmed that 6,243 booking-form entries leaked, while no leak of customer data from the shopping sites was confirmed ^[1][2][3]. H2O ID members should beware of suspicious emails, SMS and calls impersonating the company sent to their registered email or phone, avoid unknown URLs, and note that the company only sends notices from noreply@h2o-retailing.co.jp ^[1].

Industries mainly affected: Retail