Sakura Internet Breach: Data on 1.36 Million Accounts at Risk

Sakura Internet, a Japanese provider of cloud and data center services, has disclosed a breach: unknown actors gained access to an internal sales management system that stores data on customer contracts and memberships. In an update to its initial notice, the company said the incident may have affected as many as 1,360,563 accounts. The exact number of those affected is still being refined as the investigation continues.

Sakura Internet is a major player in Japan's digital infrastructure, offering web hosting, VPS, public cloud, data center services and GPU computing. The company has been selected as a domestic supplier for Japan's government cloud program, which makes it strategically important: it reduces the country's dependence on foreign hyperscalers.

How the breach was discovered

According to the company, the attackers infiltrated its IT system on August 9. The incident came to light later, in the course of investigating a separate breach of the Sakura Rental Server service. That case proved to be smaller in scale: unauthorized logins were performed on 583 accounts, the attackers gained access to customer systems and user data, and they installed malware in Sakura's infrastructure.

The company says it has revoked all compromised credentials and removed the malware. The discovery of the larger leak, however, gave the incident far greater significance. Based on the data gathered so far, 1,360,563 accounts were potentially compromised, although data exfiltration has not yet been confirmed.

What about the data

Sakura stresses that passwords are stored in hashed form and would be difficult to recover even if stolen. In addition, no bank card data was stored in the affected system. The company has notified the relevant authorities and is contacting affected customers individually.

Sakura did not specify exactly what kind of malware it found, though it has not reported any service disruptions or downtime. BleepingComputer was unable to find any extortion or leak group claiming responsibility for the attack; Sakura Internet has not yet responded to a request for additional details.

Source: Bleeping Computer