Sony Life finds 2.9 million more policy records leaked in breach

Sony Life Insurance says the intrusion into its policyholder website last month leaked far more than it first reported. In its second notice on Monday, the Japanese insurer said further investigation found about 2.9 million records from its own insurance policies had leaked, including policies that have already ended.

Sony Life found on Tuesday, October 27 that a third party had accessed the Customer Web Service site, where policyholders check their contracts and change their address and phone number, and other systems. Its first notice the next day covered only about 385,000 policies it had sold as an agent for Medicare Life Insurance, with policyholders' and insured people's names, dates of birth, sex, addresses, phone numbers, policy numbers and contract details. It reported the breach to Japan's Financial Services Agency.

What else leaked

The newly found Sony Life policy records include the policy number, name, address and phone number. Health information and medical history, My Number identification numbers, credit card details, bank account details and email addresses are not included, the company says. Taken together with the Medicare Life records, the disclosed total now exceeds 3.2 million records, though Sony Life counts policies, not people.

The attackers also took the email addresses and agent numbers of about 780 people at sales agencies, and the email addresses and employee numbers of about 12,500 Sony Life employees. Sony Life says it has found no misuse of customer information as of November 9 and will contact affected customers and agents once it is ready.

Services still offline

Six online services remain suspended: the Customer Web Service, the Sony Life app, the direct claims service, two document-checking sites and an exchange-rate lookup. Sony Life says reopening will take time because it depends on fixing the cause and assessing their safety. Customers can still make claims and changes by post or through their Sony Life representative, and can get tax deduction certificates on paper or electronically through the government's Mynaportal.

The company warns that the leaked data could be used in emails, texts and calls posing as Sony Life, and asks customers to check any contract change or procedure they did not request with its customer centre.

What is not known

Sony Life has not said how the attackers got in, which systems besides the Customer Web Service were reached, or how many individual people the records cover. No group has publicly claimed the attack.