Three major Japanese insurers have confirmed that personal information belonging to more than 710,000 policyholders leaked after unauthorised access to their customer websites. The companies are Aioi Nissay Dowa Insurance, Mitsui Sumitomo Insurance and Mitsui Direct Insurance, all subsidiaries of MS&AD Holdings.

Their customer-only websites and quotation websites were subjected to unauthorised access, and subsequent investigations confirmed the leak. The leaked information includes policyholders' names, addresses and phone numbers. Aioi Nissay Dowa also reported that the last four digits of credit card numbers were included in some records, but security codes were not leaked. At this time, no secondary damage, such as misuse of the information, has been confirmed.

What each insurer has confirmed

Aioi Nissay Dowa said on 6 November that its investigation had confirmed exposure of about 444,000 customer records. Suspicious access was detected on the night of 2 November, and customer services were suspended from 3 November. As of noon on 5 November, the suspended services included the policyholder page, One Day Supporter, e-travel overseas travel insurance, My Agent, the corporate customer web service, e-G1 and online accident reporting.

Mitsui Sumitomo Insurance said on 6 November that its investigation had confirmed exposure of about 37,000 customer records. The company states that credit-card and bank-account information is not included. Its services were still suspended as of 8 a.m. on 9 November, including policyholder pages, My Agent, 1DAY insurance, Net de Hoken travel, golf and cycle products, disaster and hail alerts, corporate customer web services, e-G1, Mimamoru Car Insurance, GK Car Insurance Connected customer portals, online accident reporting and MS Compass. Telephone, paper and agent-based alternatives are available while the online services remain down.

An industry roundup published on 6 November reported that both insurers had suspended online services, including contract-holder pages and online accident reporting, after detecting unauthorised third-party access. Mitsui Sumitomo listed 12 suspended services as of that Thursday. Neither company's notice said which systems were accessed, whether personal data was leaked or how the access occurred at that stage; the leak figures followed in the 6 November updates.

No misuse confirmed so far

All three insurers say no secondary damage, such as fraud using the leaked information, has been confirmed so far. The investigations continue, and the companies have not said how the attackers gained access or who was behind it. Customers should treat unexpected messages claiming to be from their insurer with caution, and use the insurer's official channels rather than links in unsolicited messages.

Part of a wider wave of Japanese breaches

The insurers are among several Japanese companies to disclose data breaches in the same week. SMBC Consumer Finance said on 5 November that data on up to 320,118 people may have leaked, including names, birth dates, addresses, mobile phone and driving licence numbers, as well as employment details, annual income and loan guarantee amounts, after unauthorised access was detected on 2 November.

NTT Docomo said on 5 November that some customer data had leaked, with up to about 300,000 records in scope, after unauthorised access was detected on 4 November. Its 6 November update identified names, birth dates, addresses, phone numbers, email addresses, identity-document numbers and contract and plan data among the exposed fields. The pattern of disclosures, across insurers, lenders and telecoms firms in the same days, underlines how widely unauthorised access to customer-facing systems has spread in Japan this month.