From our other sites
The story
Nifty announced on the 19th that its line application and reception management system was hit by unauthorized access from outside, potentially leaking the contract information of up to 542,513 customers of its fiber-optic services such as @nifty Hikari. Those affected are customers who applied for a line since 2019, with leaked data potentially including member ID, name, gender, date of birth, address, phone number, and email address — though bank account and credit card information was not affected. On the forum thread, many expressed surprise that Nifty still exists (“wait, Nifty’s still around?”), while others speculated about a possible connection to the recent KDDI-related suspicious email scare, and some voiced fatigue over having to change their passwords yet again.
10/19 (Mon) 20:00
Asahi Shimbun
Internet service provider “Nifty” announced on the 19th that it had suffered unauthorized access from outside, potentially leaking the personal information of up to 540,000 customers. The leaked data reportedly includes members’ names, addresses, phone numbers, and email addresses for its services.
Source: topics.smt.docomo.ne.jp / Original article here
What people said
Seriously, enough already.
Another password change?
Fiber-optic (hikari) is dangerous
What are you even talking about?
Something's not right in the head.
Nothing's wrong.
Companies have no choice but to dump their cash reserves into IT investment now.
Same as after the earthquake.
https://www.nifty.co.jp/newsrelease/nifty202610195434.htm
2. Information That May Have Been Affected (Potential Leak Scope)
・Number of accounts affected: Up to 542,513
・Customers affected: Customers who applied for a line since 2019 (excluding applications via our website)
・Services affected: @nifty Hikari, @nifty MAX Hikari, @nifty au Hikari Plus
・Items affected: Member ID, name, gender, date of birth, address, phone number, email address
※The above represents the full list of information that may have leaked; the actual scope of the leak is still under investigation. Note that this system does not store bank account or credit card information, so these are not included in the affected scope.
Maybe it leaked from the au side?
All the affected services use au lines, right?
nifmo runs on Docomo lines though.
The only safe and secure place left is 5ch.
Back in the 2channel days, there was already a precursor case — the leak of "●" (paid-pass) purchaser data.
I usually skim the header to check things, but they'd sent it using my actual Nifty ID…
I caught it right away and changed the password I'd kept for 30 years — honestly kind of shook me.
Not Nifty, but scammers sometimes send from the exact email address you use, which is unsettling every time.
A scam mail addressed to Address A, sent from Address A.
but this time it's their own in-house system?
Nifty doesn't own physical lines itself, so its connectivity services run over carrier lines.
It looks like mostly services using au lines are affected, so that's probably what's going on.
They also run business email services, so if the core system got breached, the damage could be huge.
If this traces back to KDDI's data for each provider, I'd expect the WiMAX carriers to put out their own announcements in a few days too.
And I only changed it two days ago…
Passwords aren't really the issue here, are they?
Sounds like it's the personal info from when you signed the contract.
Tax personal data.
I wish they'd just ban companies from collecting personal info going forward.
People and JustNet are gone though… (two other old Japanese ISPs)
The last one was about email — because of the KDDI system.
Re: #1 here is about the fiber-optic line service.
Ugh, seriously?! Both are major companies.
Isn't there nothing left for them to steal at this point?
So far I've been hit by Times (parking), Burger King, Hanshin-Hankyu, Joshin, and SoftBank. Who's next?
Guess that means I'm not affected either then. Good to know.
I bet they don't even have backups, if anything.
No wonder everyone's moving their servers to AWS.
Nifty was acquired by Nojima a while back — it's no longer connected to Fujitsu.
I don't exactly have an image of Fujitsu as a company that never screws up, though.
Telehodai was an NTT thing (the old flat-rate late-night phone line service).
Background and Key Points of This Story
Nifty was spun off from the Fujitsu group in 2017 and became a wholly owned subsidiary of Nojima in 2023 — a history that came up repeatedly in the thread. The data reportedly leaked this time consists of contract information such as member ID, name, address, phone number, and email address, with passwords and payment information excluded. Some posts in the thread conflated this incident with the recent “spoofed emails sent via a KDDI-provided email service” scare, but according to Nifty’s announcement, this is a separate case involving unauthorized access to its own line application and reception management system. The fact that the affected services run on au lines led some to speculate the root cause lies with carrier-side infrastructure, though there’s no confirmed information backing that up at this point. Amid a string of personal data leaks, there was also a noticeable gap in perception, with some pointing out that “this isn’t something you can fix by just changing your password.”
*This article is compiled and summarized from the 5ch (News Flash+) thread “[Unauthorized Access] Nifty Hit by Unauthorized Access, Up to 540,000 Customers’ Data Possibly Leaked — Addresses and Phone Numbers.”
Leave a Reply