Lashinbang data breach (count not disclosed): ID document numbers and bank details may have leaked — what sellers should do

The company says it is sending individual notices to people whose data may have leaked, in stages. What is affected differs depending on which services you used and how.

If no notice has arrived yet, or you want to know which of your data is involved, open the company's official website yourself and use the dedicated personal-information inquiry form linked from its notices (handled on weekdays, 10:00–18:00 Japan time). Reach it from the official site rather than from a link in an email or text message.

The company warns that emails, text messages, letters and phone calls posing as the company or as other parties may arrive, and asks customers not to open the links in them or enter or give out personal information.

In particular, the company says it never sends emails that steer customers to LINE or PayPay (a messaging app and a payment app widely used in Japan) to register. Do not click the links in such emails; delete them (how to spot these: What is phishing?).

An account number and holder name are details you give out so that people can pay you, and on their own they cannot be used to withdraw money. Withdrawals and transfers require things like your cash card and PIN, or your online banking login and authentication codes.

The thing to watch for is a contact from someone claiming to be your bank, the company or the police who uses your account details to sound genuine and says your account is being misused or a refund needs processing. Never give out your PIN, login details or one-time passwords (single-use authentication codes) by phone or email.

Also check your passbook or banking app for deposits, withdrawals or debits you do not recognize, and contact your bank immediately if you find any.

The data at risk is the "type and number" of the identity document. The notice describes it as number information rather than images, but combined with your name, address and date of birth it could be used in applications made in your name.

As a precaution, consider registering a self-declaration with Japan's credit bureaus (CIC, JICC and the Japanese Bankers Association's credit information center). Member lenders and card companies see it during credit checks and review applications more carefully. The steps, and how to request your own credit report to check for unfamiliar contracts, are covered in what Times Car members should do after the breach.

The company says no credit card information or passwords leaked, so there is no need to rush to reissue a card or change your password because of this incident alone.

The exception is if a fake email tricked you into entering a card number or password. Contact your card issuer about the card, and change the password straight away. If you use the same password on other services, this is a good moment to separate them (Choosing a password manager).

If you sent money or entered bank or card details in response to a suspicious contact, contact your bank or card issuer first.

In Japan you can also call the police consultation line (#9110) or the consumer hotline (188). The sooner you report it, the better the chance of stopping the loss.

Article 16 of the Secondhand Articles Dealer Act requires dealers to record the transaction date, item and quantity, distinguishing features, the other party's address, name, occupation and age, and the verification method used. Article 18 requires those records to be kept for three years from the date of the last entry.

First, split the data you hold into "required by law" and "kept for business convenience". Delete the legally required records when their period ends, and set a much shorter limit for everything else, such as deleting it once a payout is complete, with automatic deletion rather than manual clean-up.

The bank account for a buyback payout is needed to make the payment. If you keep it to make the next application easier, let customers choose whether it is saved, and consider deleting it once the payment is complete for those who do not opt in.

ID document numbers and consent-form images do not need to be read day to day by order processing or member pages. Keep them in a separate store with separate permissions so that a breach of the member or order system does not take them too, and put multi-factor authentication on admin logins (Choosing multi-factor authentication).

For more on reviewing services that hold identity documents, see the operator section of the Times Car article.