Japan data leaks: Which poses greatest risk, licenses, credit cards or My Number cards?

An email from Times Car apologizing for a major personal information leak.

TOKYO — Leaks of personal information held by companies and other organizations have surged due to unauthorized access. The compromised data ranges from driver’s license and credit card details to names, addresses and phone numbers. But which types of information pose the greatest risk of misuse?

The first type of information cited by Hiroyuki Minami, a cybersecurity expert and professor at the Hokkaido University Information Initiative Center, was an image of a driver’s license.

“They are widely used as identification documents, so (leaked images) pose a considerable danger,” he said.

In Japan, many identity verification procedures can be completed using only an image of a driver’s license. A leaked image could be used to impersonate the license holder, potentially allowing fraudsters to obtain credit cards or take out loans from consumer finance companies. There is also a risk that a mobile phone contract could be taken out in the victim’s name and the phone then used for fraud or other crimes.

Times Car, a car-sharing service in Japan, has announced that some 1.6 million records, including driver’s license images, were leaked due to unauthorized access.

Minami recommends that people promptly notify a credit reporting agency such as Credit Information Center Corp. (CIC) if they learn that an image of their driver’s license has been compromised. This can help prevent credit cards and loans from being obtained in their name.

What, then, if an image of a My Number identification card is leaked?

“If prescribed identity verification procedures involving the card are followed, the risk is not particularly high,” Minami said.

Identity verification using a My Number card requires several steps, including scanning the card with a smartphone and registering a password. Minami therefore believes that even if an image of the card is leaked, it would be difficult for someone to use it to gain access to the cardholder’s personal information.

What about credit card information linked to various payment services?

In recent years, many companies have introduced two-factor authentication, such as sending a one-time passcode via text message to a preregistered mobile phone number. These safeguards make it difficult to misuse a credit card number even if it is leaked, suggesting that there is no need to panic.

Professor Hiroyuki Minami of the Hokkaido University Information Initiative Center is seen in this photo provided by the individual.

Minami recommends that consumers not leave their credit card details stored on online shopping sites.

“Entering the necessary information every time you make a purchase is certainly inconvenient. But doing so can provide an additional measure of security. People need to recognize that convenience and security involve a trade-off,” he said.

By far the most common types of information exposed in personal data breaches reported almost daily are names, dates of birth, addresses, phone numbers and email addresses.

These details alone, however, are generally not enough for someone to impersonate a victim and fraudulently obtain a credit card. While the risk of such misuse appears relatively low, leaked phone numbers and email addresses could lead to an increase in fraudulent calls and phishing emails.

Individuals must remain vigilant to protect themselves, including by avoiding carelessly opening links in emails from unknown senders.

Japan’s Act on the Protection of Personal Information stipulates that businesses must endeavor to “delete the personal data without delay if they no longer require it.” Although government bodies and companies are strengthening their safeguards, this remains only a best-efforts obligation, prompting growing calls for stricter management of personal information.

Minami said, “Each person needs to consider whether to prioritize convenience and actively entrust companies with their personal information, or to prioritize security even if that means accepting some inconvenience.”

(Japanese original by Yin Tanaka, Business News Department)