Sakura Internet hack exposes data of up to 1.36 million accounts

Japanese cloud and data center service provider Sakura Internet disclosed that hackers accessed its sales management system, where customer contract and membership information is stored.

In an update today to the initial notification from Monday, the company says the incident may have impacted up to 1,360,563 member accounts.

However, as the investigation continues, the exact number of affected accounts remains to be determined.

Sakura Internet is a major Japanese digital infrastructure company providing web hosting, VPS, public cloud, data-center, and GPU computing services.

It has been selected as a domestic provider for Japan’s Government Cloud program, making it a strategic entity in the country that reduces dependence on foreign hyperscalers.

According to the firm’s announcement, hackers accessed its IT system on August 9. The incident was discovered later during the investigation of a separate breach at the Sakura Rental Server service.

That hack was less severe, involving unauthorized logins to 583 accounts, access to customer-facing systems and client data, and the installation of malware onto Sakura’s systems.

The company says it invalidated all abused credentials and removed the malware; however, the discovery of the larger exposure makes the incident more significant.

Based on data collected in the investigation so far, 1,360,563 accounts were potentially compromised, though no data exfiltration has been confirmed.

The company said that stored passwords are hashed and should be hard to decipher even if stolen, while it also specified that the compromised system does not store any credit card information.

Sakura informed the relevant authorities of the hack and is individually notifying affected customers about their data being exposed.

It is unclear what type of malware Sakura detected in its environment, but the firm did not mention any operational or service disruptions.

GeekFeed could not find a ransomware or data extortion threat actor claiming the attack on Sakura. We contacted Sakura Internet with a request for additional information, but we have not received a response yet.

Update 20/08 – A spokesperson for Sakura Internet has sent GeekFeed the following comment: 

“We have confirmed that this incident was not ransomware-related and did not involve any ransom demand. However, we are not in a position to disclose additional details regarding the malware involved at this time due to security considerations.”