The Tokyo Metropolitan Police Department announced on Thursday, July 17, the arrest of a systems engineer for allegedly stealing private information of about 7.6 million customers of the education service provider Benesse Holdings.
Last week, the company announced that the incident, which is considered one of the largest ever in Japan, could actually involve details of 20.7 million customers.
The discovery was made when affected customers reported receiving direct email messages and phone calls from businesses in the education sector pitching them sales offers, although they had not disclosed personal information to them.
The companies were not connected with Benesse Holdings, which is the parent of Berlitz language schools in Japan.
At the beginning of the investigation, the Metropolitan Police Department believed that an outsider was responsible for the incident; however Benesse's checks of the systems did not reveal traces of a breach.
According to local media, 39-year-old Masaomi Matsuzaki was employed at the Tokyo branch in Tama of Synform Co., which is a company within the Benesse Holdings group.
He is accused of illegal access to the company's systems and stealing the customer data with the purpose of selling it. According to Japanese media, it appears that the system engineer gone rogue managed to trade the info for several millions of yen, which would amount to tens of thousands of dollars/euros.
The reason of the intrusion seems to be the fact that he had debts of hundreds of thousands of yen accumulated on gambling and living expenses.
Using his credentials, Matsuzaki copied the information from the systems of the company on a removable storage device and sold it to a dealer for the unspecified amount. Local media reports that he admitted to this during questioning.
The stolen data referred to customers that had purchased educational products (courses and magazines) and included names, birth dates, home addresses and phone numbers. Financial details (credit card numbers, bank accounts) could also have been leaked, although there is no confirmation of this.
According to the company, Deputy Chairman Tamotsu Fukushima, who was CEO of Benesse Holdings at the time of the leak, and one of the directors, Eiji Aketa, who was president of Benesse Corp. at the time, will step down from their positions after the investigation finishes.
In an official notice and apology letter released on July 9, the company said that all affected parties would be notified as soon as they are identified as a result of the internal investigation and the police verfications.