Japanese cloud provider Sakura Internet discloses breach affecting 1.36 million members

Sakura Internet, a major Japanese provider of web hosting, cloud computing and data center services, has disclosed that hackers accessed its sales management system, potentially exposing information tied to as many as 1,360,563 member accounts. The company, which serves as a domestic provider under Japan’s Government Cloud program, said the precise number of affected accounts is still being determined as its investigation continues.

The intrusion occurred on August 9, according to the company’s timeline of events, and came to light during a separate investigation into a breach of its Sakura Rental Server service. That earlier incident, disclosed August 17, involved unauthorized logins to 583 accounts, access to customer-facing systems and client data, and the installation of malware on affected servers. Sakura said it invalidated the compromised credentials and removed the malware tied to that intrusion.

While examining the rental server breach, investigators found signs that the sales management system, which holds customer contract and membership records, had also been accessed without authorization. The company believes that access occurred before the rental server breach was detected and is now examining whether the two incidents are connected.

Sakura said the sales system stores member information, and passwords for some users, though those credentials were stored in hashed, irreversible form that the company described as difficult to decipher even if obtained. The system does not store credit card information, according to the company. No data exfiltration has been confirmed so far.

In response, Sakura has revoked authentication credentials linked to the unauthorized access, removed malware from affected systems, and increased monitoring across its environment. The company has also brought in outside forensic specialists and reported the incident to relevant authorities, and it plans to notify affected members individually.

Sakura did not report any disruption to its services as a result of the breach, and the type of malware installed on its systems has not been identified.

Already have an account? Sign in

Winston House, 3rd Floor, Units 306-309, 2-4 Dollis park, London, N3 1HF