Japanese software developer ACCESS said on Oct. 15 that its Taiwan subsidiary, ACCESS AP TAIWAN, was hit by unauthorized access affecting CROS, an operational support service used by e-commerce businesses. The company said the exposed personal data belonged to online shoppers in Taiwan, Hong Kong, Macau, and Singapore.
According to the notice, the breach covered 155,280 customer IDs and 231,998 order IDs. The names, phone numbers, addresses, email addresses, and order information tied to those IDs were exposed. ACCESS listed customer IDs and order IDs separately, but did not translate those numbers into a total count of affected individuals or break the figures down by market.
What data was exposed
The company also said account information related to a payment service was leaked, though it did not identify the provider involved.
ACCESS is listed on the Tokyo Stock Exchange Prime Market. In its disclosure, the company described CROS as an operational support service for e-commerce merchants expanding overseas. On its website, ACCESS presents the product as a service that helps Japanese businesses run recurring-purchase online commerce in Taiwan.
Card data came from unpaid orders
ACCESS said 1,671 card-data records were exposed in total. After accounting for duplicate registrations and multiple orders, the incident involved 1,305 accounts. The leaked fields included card numbers, security codes, expiration dates, names, and the linked customer ID and order ID.
Among them, four accounts had all of those fields exposed, including the security code. The remaining 1,301 accounts involved data excluding the security code. ACCESS said CROS does not store card data for completed payments. The card details exposed in this incident came from orders that had not completed payment and were still stored in the system.
Entry point traced to a BI tool used by one client
ACCESS said ACCESS AP TAIWAN detected signs of unauthorized access on a CROS server on Sept. 11. It then shut down the system on an emergency basis, isolated the server, and began an investigation. The gap between detection and the public announcement was 34 days.
The company said its investigation confirmed that the attacker obtained personal data and some configuration information readable from that server. The entry point was a BI, or business intelligence, data analysis tool used only by one CROS client company. ACCESS said it has not confirmed any personal data leak involving other client companies, and it did not disclose the name of the client tied to the tool.
Based on its investigation and log analysis, ACCESS said the intrusion occurred at the application layer of that tool. Outside the database accessible by the BI tool, the company said it had not detected other impact. It also said there was no sign that the core infrastructure of CROS itself was directly breached.
Stolen mail key used to send 11,441 unauthorized messages
ACCESS said the attacker also obtained a key for the mail service from the server and used it to send 11,441 unauthorized emails. After analyzing those emails, the company concluded that the recipient list had been prepared separately by the intruder and was not directly drawn from the personal data exposed in this breach.
Service was fully suspended and later restored
After discovering the incident, ACCESS AP TAIWAN isolated and disabled the compromised server. It also invalidated and updated the credentials used for email sending. To prevent the incident from spreading, the entire CROS service was temporarily suspended, including service used by other clients. The company also changed database passwords, and the service has since resumed.
The client company using the BI tool is in the process of reporting the matter to Japan’s Personal Information Protection Commission. ACCESS AP TAIWAN has also reported the incident to authorities in Taiwan, though the notice did not name the agency.
ACCESS said it expects the effect on the group’s consolidated financial results to be minor, but the impact is still under review. It said it will issue another notice if any matter requires disclosure.
Questions addressed in the disclosure
What personal data did the CROS breach expose?
According to ACCESS, the leaked data included names, phone numbers, addresses, email addresses, and order information tied to 155,280 customer IDs. The affected regions were Taiwan, Hong Kong, Macau, and Singapore.
Did the incident include leaked card security codes?
Yes. Four of the 1,305 affected accounts included security codes. The other 1,301 accounts did not. ACCESS said all exposed card data came from orders with incomplete payments.