Green Monster's FX Navi app possible data leak (about 6.19 million records): email addresses and survey answers among the items, and what users should do

The company warns that suspicious emails pretending to be from it or related companies may arrive, and asks users not to open URLs or attachments in unexpected emails. Email addresses are among the items, with 66,003 records.

Even subject lines that look natural to FX Navi users, such as account checks, apologies or campaign prizes, should not be acted on through the link (see What is phishing?).

X (formerly Twitter) IDs are also among the items, with 6,434 records. Ignore direct messages that look like they come from an FX Navi account, and invitations to "users-only groups".

To check whether something is genuine, open the official app yourself or look at posts on FX Navi's official account, not the link in the message.

The company says it will never ask for passwords, bank account details or credit card details by email or message, and will not solicit investments.

Messages selling automated trading tools, offering trading signals, or urging you to open an overseas trading account or deposit money into a specified account are fake if they use the FX Navi name. Even if they do not, be suspicious of offers that know your trading results or age group.

The company says it invalidated all login credentials issued before the fix. The announcement does not say whether users need to sign in again or what else users should do.

If an email says you need to sign in again, do not reinstall the app or sign in through its link. Open the official app you installed from the App Store or Google Play and check there.

For questions the announcement does not answer, such as how account transfer codes (5,120 records) were handled or whether your data is included, contact the company (email: fxnavi-202610@greenmonster.co.jp).

Use the address from the notice on the company's website, not one written in an email you received.

According to the company, the April collection was found while investigating a separate unauthorized access in October, and the period is given to the minute. Keeping API access records (when, from which device or IP address, how many records were returned) for several months or more lets you check the scope when you notice something later. As a reference for retention, the card industry standard PCI DSS requires audit logs to be kept for 12 months.

According to the company, the data may have been obtained "continuously" from the evening of April 27 to the afternoon of April 30 (about 2 days and 18 hours). In general, setting a cap on the number of records per user, per device and per IP address, and alerting someone when 80% of the cap is reached, is a first step toward noticing bulk collection early. Where to measure and example settings are in rate limiting and abuse control.

The company says it invalidated all login credentials issued before the fix. If you can revoke every credential that may have leaked in one step, impersonation with old credentials stops without users having to do anything. For your own app, decide in advance how to revoke all tokens at once and how users will sign in again afterwards.

The items that may have been obtained include data users never see on screen, such as advertising IDs, push notification identifiers and account transfer codes. In general, APIs that return other users' data also need protection against the problem where changing an ID in a request exposes someone else's data (IDOR). The company has not said that this was the cause here, but reviewing which fields the API returns and whose data it may return is a good starting point.