A customer's call exposed the leak of 521 nimoca users' card numbers from a side web service

Each leaked record holds a card number, a date of birth and an email address, with no name ^[9]. That reading comes from the author of the dev.to account, who runs AliasFleet, an email-alias service ^[2]. The author sells email aliases, so the stress on the email column should be weighed with that in mind. Breach files built for phishing usually pair a name with an email, the author wrote ^[9]. This one is "Not the one a scammer would design, but exactly the one a web service would store for login and lookup." ^[10] The author takes that to mean the attacker took whatever the service held ^[11].

That matches the system that was hit. Nimoca Co., Ltd., a Nishi-Nippon Railroad group company, runs the card ^[5]. The breached usage-history inquiry service is a website where registered users check their card history online, and only its registrants are in the file ^[7]. Suppose the site looked users up by card number and birth date, as the author suggests. Then both values had to sit in its database next to the email address ^[10].

The breach was found outside the company. Around 9am on a Sunday, a user got an email he did not recognise. He phoned the call center instead of clicking it, and the author says that call uncovered the breach ^[1]. The alarm in this incident was a rider who distrusted his inbox ^[1]. The service has been suspended since the evening of October 4, the same evening as the call, so the call came that day ^[8][21].

The response deserves credit. The author said the timeline was close to how disclosure should work, compared with the multi-week gaps common in breach coverage ^[14]. I would single out the shutdown. Someone at the operator took a customer-facing site offline on a Sunday evening, hours after one phone call ^[1][13].

The automatic emails raise the first question I'd ask. The author wrote: "A company that has to spend its disclosure explaining that its own emails were safe has a communications problem." ^[19] Under that sits an engineering question. If the intruder's requests made the service send those messages, its own mail log recorded the signal the rider saw, all in one place ^[18].

The announcement does not say how long the intruder was inside before a customer happened to notice ^[17]. The author called that the open question, and the one that decides how bad this gets ^[17].