NIFTY Line Application System Breach (Up to 542,513 Records): Member IDs, Names, Addresses and Phone Numbers May Be Exposed — What Fibre Customers Should Do

According to the notice, the scope covers customers who applied for a line since 2019 (excluding the company's website), for @nifty Hikari, @nifty MAX Hikari and @nifty au Hikari Plus.

Applications through the company's website appear to be excluded, but the notice does not explain in detail which application routes are covered. It also does not say whether affected customers will be contacted individually. If you are unsure whether you are affected, check with the contact below.

The items include name, address, phone number and email address. Together, they make it possible to create convincing emails and texts with your name and address correct.

The company asks customers to watch for suspicious emails, calls and text messages pretending to be the company or related parties, and not to open the URLs in them or enter personal data. Even if a message is about an "apology", a "line contract check" or a "refund" (examples from this site), do not open its links; check through the official website you open yourself from a bookmark or search (how to spot them: what phishing is).

The company says that, in connection with this incident, it will never contact customers individually by email, phone or similar means to ask for PINs, passwords, credit card details and the like. Treat any contact asking for these as fake, even if it claims to be the company.

The items also include member ID, date of birth and address. A caller who knows your member ID or birth date has not proved anything. Do not answer; hang up and call back on a number you look up yourself. Apply the same approach to anyone visiting your home or to letters.

Unlike an email address or phone number, a birth date cannot be changed. This time it was among the items alongside name and address.

If you use your birth date (such as "0815") as a bank or credit card PIN or a phone screen lock, change it now. This is general advice from this site, not guidance from the company.

Passwords are not among the items that may be affected and are not mentioned in the notice. The company has not asked customers to change passwords.

Not being mentioned, however, does not confirm that passwords were safe. If you use the same password for @nifty and other services, this is a good time to make them different. A password manager is the practical way to keep track.

The notice lists the dedicated @nifty line (phone 0120-924-719, toll-free in Japan, 10:00 to 18:00 every day). Check the number on the company's notice page opened yourself, not in a contact you received.

If you have already given or entered personal data after a suspicious contact, start by asking this line. If you paid money or gave bank or card details, also contact your bank or card company and the police consultation line (#9110 in Japan).

In general, vulnerability testing and monitoring tend to start with the websites customers use. Internal tools for managing and processing applications, however, often hold as much personal data as the customer-facing forms, or more, in one place.

Put every system that holds customer personal data on a single list, whether customer-facing or internal, and write down for each one where it can be reached from, whose accounts use it, and where its activity logs are kept. Do not split the scope of checks by customer-facing versus internal; apply the same checks to everything on the list.

This incident covers applicants since 2019. In general, records of completed applications are rarely needed in day-to-day processing.

Decide how far back the processing screens can look, and move older records to separate storage or reduce their items. That keeps the number of people and items in scope smaller if a management tool is compromised. Keep records you are legally or contractually required to retain separately from the working screens.

The company stated clearly in its notice that it will not ask for PINs, passwords, credit card details and the like about this incident. That is information customers can use straight away to spot fake contacts.

Before an incident happens, decide what your organisation will never ask for by phone or email, and which senders you use for important notices, and publish them on your official website. Then you can issue the same guidance on the day. For sender spoofing protection, see SPF, DKIM and DMARC against spoofed email.