Suntory Group Personal Data Leak (About 90,000 Employees and Partner Staff, and Other Groups): Names and Email Addresses Leaked After Unauthorized Access to an External Cloud Service, and What Applicants and Customers Should Do

Depending on the group, the leaked items are a combination of name, email address and phone number. An email with the right name and address looks genuine. Treat any message that claims to be Suntory or a group company (Monte Bussan, Izutsu Maisen, Suntory Beverage Solution and others) and asks you to open a link or enter information with suspicion. To check, use the official site you open yourself, not the message (see what is phishing?).

The group covers applicants to the business-track open selection (early and regular) of Suntory Holdings' 2026 new-graduate recruitment. The leaked items are described as "applicant My Page registration data and so on (name, email address, phone number, etc.)".

If you get a message about selection results, a job offer, a change of interview date or extra documents, do not follow the link; check in the recruitment My Page or the official site that you open yourself. If you are asked for a bank account number, photos of ID documents or a fee, stop there and contact the company through the notice page. A similar case involving job applicants is covered in the MyBRANDS unauthorized access.

For Mar de Shine, the email addresses of 7,323 people registered as of the end of 2023 are affected. For Izutsu Maisen, the names and delivery location information of 96 delivery customers and delivery staff are affected.

Even for messages offering an apology coupon, a prize or a delivery-address check, do not open the link and enter your address or card number. The company says payment data is not included, so nothing in the notice calls for checking your card number over this incident.

The leaked groups include names and email addresses of partner-company employees, names and phone numbers of business-partner employees and others stored on two company mobile phones, and names and job titles of employees of Suntory's business partners. In general, a name, a job title and an email address together make it easier to fake an invoice or a request to change bank details in the name of a contact (business email compromise).

Check any request to change bank details or to pay urgently by calling the contact on the number you have always used, not the one in the email.

The company lists an inquiry form (24 hours) and a free-dial number, 0120-050-310 (operator, 9:30–17:00, closed on Saturdays, Sundays, public holidays and the year-end period), as its contact points for this incident. Confirm the number and the form on the notice page on the company's official site, not in a message you received.

According to the notice, the company identified the names of the leaked files on October 28, the day it detected the anomalies, and confirmed on October 29 that some of them contained personal information. Knowing the file names is not the same as knowing whose information is inside. In your own organisation, list the files in shared cloud storage that contain personal information, such as rosters, applicant lists and exported contacts, with their location and owner (security inventory checklist).

The leaked groups include registrant data as of the end of 2023 and contacts stored on two company mobile phones. The notice does not say in what form these were kept in the cloud. In general, a roster exported at one point in time, or a backup of a device's contacts, tends to remain even after it is deleted from the original system. Check your organisation's cloud for export files that are no longer in use and delete those you do not need.

The largest group this time was employees and partner-company employees (about 90,000). When a roster leaks, fake invoices can reach business partners too. Prepare in advance a short message asking partners to confirm by phone any bank-detail change request in your name, together with the list of people to send it to, so you can issue the warning on the day you disclose (stopping spoofed email that uses your domain).