Japan built a fortress around My Number and left the side doors open

Japan’s core My Number infrastructure has not been publicly identified as the source of a major data breach. The ecosystem around it is another matter. The Digital Agency that runs the program has disclosed two data leaks in recent months, a vendor serving a My Number card reservation system has exposed up to 2.2 million email addresses, and companies nationwide are reporting breaches at a sharply accelerating pace. The question is whether a decentralized design can protect a national ID when its weakest connected systems are the ones being hit. […] The incident most directly connected to My Number services involved an email vendor supporting municipal card-issuance appointments. Municipalities including Nagakute City use TKC Corporation’s My Number Card Issuance Reservation System, and TKC contracts Arara Co. to send confirmation emails. A breach at Arara exposed up to 2,230,812 email addresses. No My Number identifiers leaked, and the emails resumed on November 10. The addresses were associated with a My Number card appointment service, creating a potential audience for phishing messages impersonating official notices. Attackers do not need to compromise the card itself if they can trick users into disclosing credentials. The agency itself has been hit twice.

Japan’s core My Number infrastructure has not been publicly identified as the source of a major data breach. The ecosystem around it is another matter. The Digital Agency that runs the program has disclosed two data leaks in recent months, a vendor serving a My Number card reservation system has exposed up to 2.2 million email addresses, and companies nationwide are reporting breaches at a sharply accelerating pace. The question is whether a decentralized design can protect a national ID when its weakest connected systems are the ones being hit.

The incident most directly connected to My Number services involved an email vendor supporting municipal card-issuance appointments. Municipalities including Nagakute City use TKC Corporation’s My Number Card Issuance Reservation System, and TKC contracts Arara Co. to send confirmation emails. A breach at Arara exposed up to 2,230,812 email addresses. No My Number identifiers leaked, and the emails resumed on November 10.

The addresses were associated with a My Number card appointment service, creating a potential audience for phishing messages impersonating official notices. Attackers do not need to compromise the card itself if they can trick users into disclosing credentials.

The agency itself has been hit twice.