EPARK Relax & Esthe "PeakManager" data breach (about 22.18M records): health notes leaked too — what salon customers should do

The company explains that PeakManager is a ledger in which each salon enters and manages its own customer data; only the name is required, and phone number and email address are optional.

So even if you only booked by phone or walked in, you may be included if the salon entered your name or contact details into PeakManager. People who never used the EPARK website or app are not excluded.

No list of salons using PeakManager has been published. If you are unsure, ask the salon you use, or contact the operator's helpline listed below.

The leaked data combines name, address, date of birth, phone number and email address, and shows which salon you used. That is enough to build convincing messages offering "an apology coupon", "a booking confirmation" or "a points refund".

The company says it will never ask for card numbers or security codes by email or SMS in connection with this incident. If you get such a message, do not open the links; check through the salon's official website or a phone number you already knew (see What is phishing?).

In its first notice the company said that passwords for the PeakManager customer My Page may have leaked in encrypted form, and asked customers to change them.

If you remember creating a My Page through a salon's online booking, change that password. If you are not sure where you created it, ask the salon whether its booking My Page runs on PeakManager.

The encryption method has not been published. Depending on the method, the original password could be worked out (see What is password hashing? for the difference).

If you use the same password for email, online shopping or other services, change it there too. A password manager is the practical way to keep a different password for each service.

The leaked notes field holds handover notes that salons wrote for treatments. According to the company, it partly contains health conditions and other sensitive personal information (a category defined in Japanese law, such as medical history, that requires special care).

A caller who knows your physical condition or which salon you go to is easy to believe. Even if they get the details right, that alone does not make them genuine. If you are asked to buy something or pay, do not decide on the spot; hang up. In Japan you can consult the consumer hotline (188).

Japan's Act on the Protection of Personal Information lets individuals request that use of their data be stopped or the data deleted when a reportable leak has occurred (Article 35(5)).

Each salon manages its own customer ledger. If a salon you no longer visit still holds your data, you can ask it to delete it.

In this case the notes field, meant for treatment handover notes, ended up holding health conditions and even entries that may be card data. A free-text field with no rules collects anything.

Agree in your shop what may be written (for example, areas to avoid during treatment) and what may not (card numbers, detailed diagnoses and the like), and do not copy paper intake forms into it word for word.

From the customer's point of view, the salon is who they gave their data to. Do not just wait for the operator's notice; know which system your shop uses and which items you registered, so you can answer questions.

A salon's legal responsibility depends on its contract and how it uses the service. If unsure, check with the Personal Information Protection Commission's consultation service or a similar adviser.

What the company stopped was a misused database connection account. If one account can read every salon's customers, leaking that account's credentials is enough to take everything.

As a first step, list the connection accounts used by the application, operations and analytics, and write down which tables each can read and how many rows. Remove bulk-read rights from any account that does not need them.

Normal use of the application screens reads one salon's data at a time. Configure the database audit log or your cloud monitoring to alert when a single connection account reads several salons' customer data in a short time. Start by measuring the largest normal overnight batch and alerting above that level.

In this case the data was deleted after being transferred, and the company has switched to a backup database and completed restoration.

In general, if the account that connects to the production database can also delete backups, you lose your way back along with the data. Check that production credentials cannot delete backups. See Backup essentials: the 3-2-1 rule and a recovery plan.

Here only the name was required and phone and email were optional, so the same person could not be identified and the leaked records could not be converted into a number of people. Without that, contacting individuals is hard too.

Collecting no more than you need and being able to reach the people concerned after a leak both have to be designed for. At minimum, make sure you can reliably trace which salon registered which record, so notification through the salons remains possible.