Nojima Online and Used-Phone Buyback Site Unauthorized Access (About 7 Million Records): Names, Addresses, Phone Numbers and Encrypted Passwords, and What Members Should Do

The leaked items include name, date of birth, gender, address, phone number and email address together. With that, a message can get your name and address right. The company also warns that the data could be abused for impersonation emails and phishing, and asks you not to open links or attachments you do not recognise.

If you get a message about an "apology coupon", "re-confirming your member information" or "points about to expire", do not open the link in it. Open your browser yourself and check on the official site. Fake texts (smishing) work the same way (what is phishing?).

The notice says the leaked passwords were encrypted. It does not ask members to change passwords. As of the November 2 notice the two sites were temporarily suspended (we found no reopening notice as of November 4), and the method of encryption has not been disclosed.

So we suggest this: if you use the same password as your Nojima Online or buyback-site account, or a slight variation of it, on email, other shops or social media, change it on those other services. Your login ID and email address also leaked, so reuse could give someone a starting point for trying other services. This is our view, not the company's guidance. A password manager is the realistic way to sort this out, and how to check if your password was leaked shows whether a reused password appears in past leaks. Turn on two-step verification where you can.

If the company guides members to set a new password after the sites reopen, follow that guidance.

The company says it holds no credit card information on the two sites. So treat any message that asks you to enter a card number or "re-register your card" with suspicion. A caller who gets your name and date of birth right is not proving anything, because that is exactly the data that leaked.

If you are asked for a password or card number, do not give it. This is our advice.

You can create a new email address, but your phone number and address are hard to change. In general, scam calls and texts can reach a leaked number under names other than Nojima (our view). Turning on your phone's spam call and spam text filters reduces how many arrive (smartphone security basics).

The company gives the Nojima Customer Center (0120-574-853, 9:30 to 19:00 JST, a Japanese freephone number) as the contact for this incident. Take the number from this notice on Nojima's official site, not from a message sent to you.

The notice says encrypted passwords. In general, passwords are stored not with reversible encryption but with a one-way hash (a deliberately slow method combined with a random value per user). Check how your site stores them and when the strength setting was last reviewed (how to store passwords). Which of the two applied here has not been disclosed.

The notice says the company handles payment data without holding it, so the two sites contain no credit card information. Not holding data reduces the harm of a leak. Apply the same thinking to date of birth and gender: why are they stored, and could unused fields be left uncollected or deleted? The notice also says members who withdrew are not included, and the same inventory covers what happens to data after withdrawal.

According to the notice, the access was detected and confirmed on Sunday, November 1, and announced on Monday, November 2. The notice lists cutting off external access, consulting the police, suspending the sites and posting notices on the website and social media as responses after discovery, but does not give the dates they were carried out. Decide today who would decide, who would take the site down and who would publish if it happened on a weekend at your organisation.