Sharefull breach may expose 7.5 million gig workers' bank details

Sharefull, a Japanese app that matches people with short, one-off shifts of part-time work, says personal data on up to about 7.5 million user accounts may have been taken from its internal management system. In a notice on Monday, the company, which brands the service as part of the Persol group, said a third party accessed the system at about 23:30 Japan time on Wednesday, November 4 (14:30 UTC).

Sharefull says it detected the access at about 09:45 on November 5 and had blocked the route the intruder used by 14:00 that day. It spent November 6 to 8 working out what was affected, says no further data has left since, and is running the service as normal.

What may have been taken

For workers, the exposed records include name and its kana reading, phone number, email address, address, date of birth, the bank account used for wage payments, an emergency contact's relationship and phone number, information related to residence status, and account details such as registration date, number of jobs worked and preferences. PINs and passwords are not included. The records also hold the URLs of the server where users' face photos are stored; Sharefull says the photos themselves sit on a separate server, to which it has also cut off access.

For businesses that post jobs, up to about 7,500 companies are affected: company name, address and phone number, and the name, department, title, email address and phone number of the person in charge, along with part of Sharefull's sales management data.

Sharefull says wage and points data, employment contracts and work records, identity document images, My Number identification numbers and card details were not in the data the intruder reached, and that no one viewed wages or made payments or point transactions without permission.

What Sharefull is doing

The company has reported the incident to Japan's Personal Information Protection Commission, is working with an outside investigator, and will contact affected users by email. It warns users to expect fake emails, texts and calls posing as Sharefull or official bodies, and says it never asks for bank PINs or passwords. Its separate shift-management service, Sharefull Shift, shows no sign of unauthorised access, it says. Users can reach the company through a dedicated support form, and the company's news page will carry any updates.

What is not known

Sharefull has not said how the intruder got into the management system, how many of the 7.5 million accounts belong to active users, or whether a ransom demand has been made. No group has publicly claimed the attack.