Police arrest two in Japan data theft case

Thieves allegedly copied personal information of four million customers

Blackmailers attempted to extort almost $90,000 from one of Japan's largest phone companies by threatening to reveal a leak of private data belonging to four million customers before a major shareholder meeting, according to local press reports.

Two men have been arrested by Tokyo police investigating the case, the Asahi Shimbun reported yesterday.

The alleged extortion attempt involved the personal contact details of nearly four million customers of fixed-line internet services operated by KDDI Corp. 

As well as contact information, other identifying information such as gender and date of birth were copied from tens of thousands of customer records.

In the past, this kind of data has been used to swindle individuals and financial institutions out of large sums of money in identity theft cases.

KDDI apologised for the privacy breach in a news release, stating that it would review internal procedures to prevent a recurrence. Account passwords had not been stolen, the company stressed.

The blackmailers allegedly revealed the existence of CD-Rs and USB Flash memory sticks containing the customer data to KDDI officials on 30 May.

Threats were made to leak news of the privacy breach to the press in advance of a meeting of KDDI shareholders scheduled for today, Japanese media reported, citing police reports.

However, the day after being informed of the apparent data leak, the company called in the police. The police appear to have monitored communications between the alleged extortionists and KDDI for nearly two weeks before making arrests.

The telecoms company said that it suspected an inside job. "We have no choice but to presume that either one of our employees or someone related to us intentionally recorded the data and brought it out," a KDDI official told the Asahi Shimbun.

More than 200 employees and subcontractors could have had access to the data, KDDI said.

KDDI also operates other services, including Japan's second largest mobile phone network, but the company said these were not affected by the data leak.

Analysts told Bloomberg that news of the privacy breach could frighten customers away from KDDI's fixed line services. 

The number of fixed-line subscribers is already falling owing to competition from competitors' internet-based phone services, and from newer communications technologies such as mobile phones.