Sakura Internet data breach

Sakura Internet initially reported unauthorized third-party access to its Sakura Rental Server environment, which was detected on August 9. The company confirmed that 583 accounts were victims of unauthorized logins, with attackers potentially accessing personal data and malware being discovered on some servers. In response, the company invalidated credentials, blocked unauthorized access paths, and restricted certain service functions while conducting a forensic investigation.

Subsequent investigation results revealed a much larger breach involving the company’s sales management system, which persisted for approximately three years from April 2023 to March 2026. This breach potentially affected 1,360,563 accounts, exposing member and contract information such as names, addresses, phone numbers, and email addresses. While the company stated there was no confirmed evidence of data exfiltration for secondary damages, it noted that credit card information remained secure as it was not stored in the system.

Additionally, the investigation into the Sakura Rental Server identified 951 accounts where user identifiers, email, and website data may have been accessed. The company also discovered a security lapse where some initial passwords for rental servers and VPS were stored in plain text without being hashed.