Photo/Illutration Nippon Telegraph and Telephone West Corp. President Masaaki Moribayashi apologizes at a news conference in Osaka on Oct. 20. (Asahi Shimbun file photo)

A prolonged, systemic failure in data security management resulted in a 10-year leak of personal information in about 9 million cases stored at a subsidiary of Nippon Telegraph and Telephone West Corp. (NTT West).

The leak reflects a significant lapse in the company’s protective measures and a stark oversight in regular security audits and monitoring.

Rather than merely a mishap of one subsidiary, the data breach has raised serious questions about the responsibility and credibility of NTT West and the entire NTT group, Japan’s leading telecom conglomerate.

The security breach occurred at NTT Business Solutions in Osaka, which handles maintenance and operation of the computer system for call centers.

A former temporary employee working at the firm had illegally taken out private information, such as addresses, names and telephone numbers, from the computer system where the data for the call centers was stored.

It is believed that the information was sold to “meibo-ya” (list brokers), a type of business or individual involved in the trade or sales of personal information and data lists, and police are looking into the case. Police should hold offenders criminally accountable through an exhaustive investigation.

What cannot be overlooked is the disturbingly negligent data protection at the company in charge of the information system. It is astonishing that the firm allowed the data to be removed using what can be described as a classical method for so many years.

According to the NTT side’s explanation, the former temporary employee downloaded the lists onto a work terminal and then transferred the data to a personal USB memory device.

This data theft continued from the summer of 2013 to the beginning of this year. A similar large-scale customer information leak that occurred in 2014 at Benesse Holdings Inc., Japan’s leading correspondence education provider, must have made the importance of measures to safeguard sensitive data widely recognized among Japanese companies.

However, this company did not implement measures to prevent downloads to terminals or connections of personal USB devices, nor did it have a system to detect suspicious activities such as mass data processing. It also neglected to monitor records of access to the system.

NTT group claims it had instructed these protective measures to be taken, but they were not thoroughly implemented. It is natural and inevitable that both NTT West President and CEO Masaaki Moribayashi and Akira Shimada, president and CEO of NTT Corp., the holding company, apologized for the massive information leakage.

Why weren’t the group’s instructions concerning data security followed at the subsidiary? Was the system of business inspection working properly? Why did the firm fail to detect the breach through an in-house investigation in the spring of 2022 triggered by the request of a client who suspected a data leak?

Many issues and questions need to be addressed and answered through a probe based on a third party’s perspective. The results of the scrutiny should be published. Moreover, organizational and managerial responsibilities should also be re-examined.

Those impacted this time include private-sector companies, local governments and other organizations, totaling at least 59 entities that outsourced call center operations.

There have been cases of product solicitations that seem to have exploited the leaked lists. The revelations must have aroused no small anxiety among clients and related parties.

NTT group proclaims that information protection is “the basis of our business activities and an important part of our social responsibility as a corporation.”

How does the group intend to atone for this betrayal of trust? It needs to be acutely aware of the weight of the responsibility that it must fulfill.

--The Asahi Shimbun, Nov. 17

Related News