HIS Subsidiary May Have Leaked Personal Data of About 140,000 People After Unauthorized Access at Outsourcer Laxragy Cloud

What happened

H.I.S. Hotel Holdings, a subsidiary of travel company H.I.S. that runs the "Henn na Hotel" chain, said on October 22 that hackers may have stolen personal data of about 140,000 members. The data came from an outside company, Raxus Light Cloud, which sends the hotel's monthly email newsletter. The data that may have leaked is names and email addresses. The company says credit card information was not included.

Key numbers and facts

• About 140,000 hotel members may be affected.
• Leaked data may include names and email addresses.
• Credit card information is said not to be included.
• Raxus confirmed on October 21 that hackers got into its mailing service, Blast Mail, and shut it down urgently.
• The attackers broke into two API servers and took data from the service's database.

Background

Raxus Light Cloud is a subsidiary of Raxus, a cloud service company. Companies often send emails through outside services like this one, so a problem at the outside firm can expose their customers' data. Separately, H.I.S. Hotel Holdings said it finished updating its booking website to fix a weakness in PHP, a common programming language.

Why it matters

Hotel members may get scam emails or be targeted for fraud if their names and email addresses are misused. The case also shows that a company's data can be at risk even when the problem happens at a partner. The company says it will look into the details and report to Japan's Personal Information Protection Commission.

What to watch

• Results of the detailed investigation by H.I.S. Hotel Holdings.
• Whether any stolen data is misused.
• Official reports to the Personal Information Protection Commission.
• Raxus's findings on how the attack happened and when Blast Mail returns to service.