SHINDO3

The Norinchukin Bank

Personal data3,176records

LEAK CONFIRMEDBilled / transaction amount / Postal addressMisdelivery · Closed (final report)

Open in the live monitor ▶
Disclosed
Jun 30, 2026
Detected
May 27, 2026
Detection to disclosure
34 days
Leak
Leak confirmed
Type
Misdelivery
Status
Closed (final report)
Security spend
Not checked yet
Compensation
Not announced

What leaked

Account dataCustomer number, Account opening date
ContactApartment names, room numbers, etc.
Financial & paymentSavings and loan balances

How many

  • Personal data of JA Sapporo customers 3,176 records

Who is affected

  • JA Sapporo members and customers

Cause

Past transaction data of JA Sapporo's head office sales division was used in testing a system tool modification and was provided to JA Group organizations and their contractors

Timeline

  1. Discovered
  2. First disclosure

Response

  • Data deleted
  • Notified individuals
  • Change process

Confirmed deletion at the recipients; sent written apologies and explanations; tightened information management and system development procedures

What you should do

  1. Watch for unexpected mail or invoices; your address is hard to change
  2. Check the company's notice to see if you're affected

Lessons for companies

  1. Never sit on a known defect. Test every change before production
  2. Use DLP: recipient checks, send delay, automatic attachment protection
  3. Don't keep ID or bank data: delete after checks or use a KYC provider
  4. Report to the PPC: preliminary in 3–5 days, final in 30 (60 if malicious)
  5. Run red teaming and AI-assisted hardening, and publish how much you invest

Sources