From our other sites
The story
On October 28, Japan Airlines (JAL) announced that personal information belonging to roughly 92,000 customers may have leaked due to unauthorized access. The breach has raised concern because it reportedly includes passport numbers and nationality — data that demands far more careful handling than ordinary membership details. On 5ch, threads debated whether the IC chip in Japan’s “My Number” ID cards is truly secure, traded speculation about which country’s hacker group might be behind the attack, and even veered into distrust over a separate incident — Kanagawa Prefectural Police reusing old driver’s licenses — broadening into general suspicion about how personal data is managed overall.
JAL: Personal Data of 92,000 Customers May Have Leaked
Oct 28 (Wed), 6:09 PM
Kyodo News
Source: topics.smt.docomo.ne.jp / Original article here
What people said
They're probably juggling like three different passports
Looks like it's about to come out that they're actually a Romulan (Star Trek alien race)
Guess you can forge all the passports you want now
This must be causing a huge uproar inside ANA too (JAL's rival airline)
When it's written in kanji you can tell them apart, but in roman letters you can't tell which is which, lol
The printed card data — My Number card, passport, driver's license — all compromised across the board.
The chips in passports and licenses are compromised too, since they just hold electronic copies of the printed data.
No telling when the My Number Portal itself gets hit, so better not link anything extra to it.
Only the data that exists solely on the chip, and its authentication method, is actually safe.
The card itself is tough, sure, but watch it turn out the leak came from the factory
The PHP vulnerability has nothing to do with user authentication either
If that vulnerability let someone hijack the web system's admin account, they could do anything within that admin's permissions
So the GMO case isn't really about individuals
The cases that look like they're about individuals — where people's home PCs even got hit — that's simply not the PHP story
If it's internal-only, you can't take reservations through the website, can you?
Save that for the ANA thread, lol
Limiting it to just "Japan" is exactly that island-nation mindset — thinking you're the only special case
Yeah, fair enough.
My daily commute is just between my room and the bathroom anyway
The Human Instrumentality Project (an Evangelion reference)… it's finally starting, huh…
If it's just a leak, sure, but once it starts throwing money and everything else into chaos, you won't be saying that anymore,
ATM theft, now that's nostalgic lol
I heard Komatsu added GPS location tracking and remote engine shutdown as a countermeasure for this
Komatsu's been doing that since way earlier, for use in deserts and tundra
Japan's still behind on this
Apparently it's more often Russian-linked groups
Bangkok used to be the first stop for tourists from all over the world
buying your ticket there made it cheaper, or something like that
no idea how it is now
Bangkok used to be the center of the world
If someone walks them through it, they could probably manage about as well as one of the Toyoko-area street kids running the show (slang for the runaway teens who hang around Tokyo's Kabukicho "Toyoko" strip)
And the one doing the walking-through is AI
Plus, the only ones that turn into news stories are the successful attempts
there's probably a mountain of failures nobody ever hears about
Wonder which one gets hit
Everyone's being way too relaxed about this
Bank deposits are guaranteed
Spread your money around and you'll be fine
Whether you could actually make today's passports with this, though, who knows??
Aren't they built with anti-counterfeiting tech?
That just comes down to how strict the people checking are
it's not the same everywhere in the world
and even though it's not the same, we're now in an era where some stranger from, say, the Arab world you've never met could impersonate you online
what's normal for you isn't necessarily normal for the rest of the world
This is gonna bring in the real deal, not just a "tokuryu" (the loosely networked, social-media-recruited crime gangs Japanese police use this term for)
Riku-ryu? (riffing on the "tokuryu" term)
Records only trace back 30 years, to the 1990s
There's no report saying they weren't doing it before that either
And the National Police Agency said afterward that it would investigate nationwide — then went silent, no follow-up since
Even within the police,
individual officers'
personal data is probably leaking out too,
Karma, basically.
Can people file for damages over this?
The biggest problem with that is that Kanagawa Prefectural Police can't exactly file a theft charge over it, can they
If it wasn't taken out under official instructions, that means it was taken from the station without authorization, right? That's straight-up theft, isn't it
It really is strange that no one's being charged with theft over it
Honestly, the Cabinet Secretariat ought to take responsibility for investigating just what the chain of command looked like here
Background and Key Points
What stands out about this leak is that it includes far more sensitive items — passport numbers, nationality — than typical membership data. In the thread, the claim that “the My Number card’s IC chip is safe” drew pushback from users pointing out it conflates two very different things: user authentication being broken versus the system’s administrative privileges themselves being hijacked, so the technical discussion ran in parallel without ever really getting sorted out. Some posts pin the attack on China or Russia, but that’s speculation, not anything officially confirmed. The mentions of Kanagawa Prefectural Police reusing old driver’s licenses are a separate matter entirely, unrelated to the JAL leak — best read as an example of how distrust over personal data handling in general spilled into the thread.
*This article is compiled from excerpts and summaries of the 5ch (News Flash+) thread “[Unauthorized Access] JAL: Personal Data of 92,000 Customers May Have Leaked, Including Passport Numbers and Nationality.”
Leave a Reply