Yakult Data Breach Exposes About 40,000 Records

The Yakult data breach has exposed about 40,000 personal records held on the company’s Japanese website, Yakult Honsha said on 30 October, four days after it found unauthorised access and shut the site’s functions down. The maker of the probiotic drink said in a filing to the Tokyo Stock Exchange that the figure is provisional and that the final count is still being checked.

The leaked personal information came from people who used the site’s contact forms and from members of a school meals website the company runs. Yakult says it held no credit card or bank account details on the site, and that it has found no misuse or secondary harm so far.

In brief

Yakult detected unauthorised access to yakult.co.jp on 26 October and stopped the site’s functions the same day.
About 40,000 records leaked, covering contact form users, school meals site members, journalists and some staff names.
Yakult has filed a first report with Japan’s Personal Information Protection Commission and consulted the police.

What the Yakult data breach exposed

Yakult’s filing and a notice now on its website list four groups of affected people. Quotes and lists below are TSN translations from Japanese.

Contact form users. People who emailed Yakult through the site’s inquiry form: name, gender, age group, address, phone number, email address and the content of their message.
School meals site members. People registered on 「たのしい給食」 (roughly, “fun school meals”), Yakult’s website for school catering: name, type of business, employer, department or contractor, work address and phone, email address and their registered password, which the company says was encrypted. Optional answers on how they heard of the site, products of interest and their reason for registering were also taken.
Journalists. People who used the press inquiry form: name, job, type of media, outlet, company or organisation, work address, phone, email and their message, plus department and job title where given.
Staff. The names of Yakult employees who handled inquiries from the first and third groups.

Yakult has not said how the attackers got in, who they were, or how far back the leaked records go. The website notice says the number of people affected and the period covered will be released “in stages”, and that affected customers will be contacted “as soon as preparations are complete”.

How Yakult responded to the unauthorised access

Yakult first disclosed what became the Yakult data breach on the evening of 26 October, saying only that it had found unauthorised access to its website and that it was investigating whether customer information was affected. On 30 October it confirmed the leak in a second notice and in the stock exchange filing, which is signed by the company’s president.

The company stopped the website’s functions on 26 October “to prevent the damage from spreading”, it says, and yakult.co.jp now opens on a maintenance page carrying the two notices. Yakult has made a first report to the Personal Information Protection Commission, Japan’s privacy regulator, and has consulted the police.

It is also warning people to watch for suspicious calls, emails and text messages, giving prize wins, delivery notices and refund offers as examples. “We will never ask customers for passwords, account numbers or credit card numbers,” the notice says, and it advises people to leave links and attachments in unfamiliar messages unopened. A dedicated helpline is being set up; until then, inquiries go to the Yakult customer centre on 0120-11-8960, open 10:00 to 16:00 on weekdays.

Contact details, not cards, are the risk in this Yakult data breach

On the numbers, this is a small incident by the standards of Japan’s recent run of breaches. Muji said this week that its app breach may have exposed up to 27.26 million records, and Sagawa Express put its possible leak at 53.23 million. The closer comparison is the trade agency JETRO, which confirmed a leak through its own website earlier this month: the same kind of target, a corporate site with forms, rather than a large consumer app.

The lack of card data limits the direct financial risk, but the data that did leak is well suited to fraud. Contact form records pair names and home addresses with phone numbers and the text of a real message to Yakult. A scammer who knows what someone asked the company can write a convincing follow-up, which is why Yakult’s warning about fake prize, delivery and refund messages matters more than it might seem.

The school meals site raises a separate question. Its members gave work details and a password, and Yakult says only that the passwords were encrypted. It has not said how, and the strength of the method decides whether they can be recovered. As at So-net, where mail passwords were taken, anyone who used the same password elsewhere should change it now rather than wait for a letter.

The press form is unusual too. Journalists’ names, outlets and messages reveal who was asking Yakult about what, which is sensitive in its own right. For people caught up in the Yakult data breach, what to watch next is the final count, the time span of the leaked records, and whether Yakult says how the attackers got in.