Rakuten Drive breach (stored data of 15,382 accounts): what was accessed and what users should do

The service says it will notify affected users individually by email or other means. Check the inbox and spam folder of the email address registered with Rakuten Drive.

Fake emails imitating the notice may also appear. Do not sign in from a link in an email; open the service yourself from a bookmark or the app. For questions, use Rakuten Drive's inquiry form or its temporary support line (0800-600-6600 in Japan, every day 9:00–17:00 Japan time, Japanese only).

If you used Rakuten Drive to back up photos or keep documents, list what you stored. If you are told you are affected, assume a third party has seen those contents.

• Driver's license images: follow what to do if your driver's license data leaks so you notice accounts opened in your name early
• Images of a national ID card, passport or health insurance card: likewise, watch for contracts or bills you do not recognize
• Contracts, invoices or documents showing bank details: verify any contact from businesses or banks using contact details you look up on their official site, not those printed on the document
• Photos of other people or documents containing others' personal data: if it is work data, report it to the responsible department at your workplace

For 313 accounts, the encrypted password and the string added during encryption were obtained and viewed. This processing is meant to make the original password hard to recover, but short or guessable passwords can sometimes be guessed given enough time (how this works: how to store passwords safely).

If you sign in with an email address and password, reset it from "Forgot your password?" in Rakuten Drive. According to the service's help pages, a new password must be at least 8 characters and include at least one uppercase letter, lowercase letter, number and symbol. If you use the same password on other services, change it there too (to check for leaks: how to check if your password was leaked; to manage them: password managers).

According to the service's help pages, if you sign in with Rakuten ID, Google, Facebook or Apple, Rakuten Drive does not store those passwords. The passwords obtained and viewed in this incident were ones stored by Rakuten Drive.

Even so, that account is the door to your files. Turn on two-step verification on the account you use to sign in (the idea: getting started with multi-factor authentication). In Rakuten Drive's security settings, you can review the list of signed-in devices and sign out any you do not recognize.

The service asks users who notice unexpected payment demands, threatening messages or apparent impersonation not to open or respond, and to consult Rakuten Drive's support or the police.

If someone demands payment with threats such as "we will publish your photos" or "we will delete your files", do not pay and do not reply. In Japan, you can also call the police consultation line (#9110). How to recognize fake notices and emails: what is phishing.

Check whether management accounts used for maintenance and operations actually need to read users' stored files. Remove read permissions that are not needed for the job, and as a baseline put opening users' files behind a separate permission (the idea: authentication vs. authorization).

Make sure that even if the password or key of a management account falls into someone else's hands, that alone is not enough to sign in. Combine multi-factor authentication (ideally a phishing-resistant method such as passkeys) with restrictions on where connections can come from.

In normal operations, management accounts rarely read users' files. A good first step is to log every read of a user file by a management account and alert the responsible person whenever even a few occur in a day. Most cloud storage services offer read logging (access logs) and alerts based on them.