SHINDO5

SoftBank

SoftBank Corp.

Personal dataup to135,022records

POSSIBLE LEAKInsider misuse · Investigating

Open in the live monitor ▶
Disclosed
Jun 12, 2025
Detected
Mar 2025
Detection to disclosure
103 days
Leak
Leak possible
Type
Insider misuse
Status
Investigating
Security spend
Not checked yet
Compensation
Not announced

What leaked

UnspecifiedPersonal information about individual customers

How many

  • Records that may have been taken out on a USB stick up to 135,022 records

Who is affected

  • Individual customers with SoftBank or Y!mobile mobile phone contracts

Cause

A former employee of a partner company entered the office of contractor UF Japan without authorization in December 2024 and may have copied customer data to a USB stick and taken it away (confirmed on security camera footage). Security management was lax and false audit reports had been made

Timeline

  1. Intrusion began
  2. Detected
  3. Date of the Security NEXT report

What you should do

  1. Check the company's notice to see if you're affected

Lessons for companies

  1. Put security requirements, audit rights and reporting deadlines in vendor contracts
  2. Report to the PPC: preliminary in 3–5 days, final in 30 (60 if malicious)
  3. Run red teaming and AI-assisted hardening, and publish how much you invest

Sources