, front page
InitialReach
How we report

Securityferret One breachChanged

Intruder at Japan's ferret One marketing platform viewed or took about 17,000 personal records and about 4,300 login email addresses, Basic's second report says

Basic, the company listed in Tokyo that runs ferret One, a marketing platform for businesses, said on 4 November that an intruder viewed or took 4,317 ferret One users' login email addresses and 16,970 records of personal information, such as names and contact details, that three of its client companies kept on the platform. Its first report, on 27 October, gave no count: it said users' login email addresses may have been viewed or taken, and that what was viewed or taken through six accounts logged into without authorisation was still being investigated.

Almost all of the personal records, 16,968, came from one client company whose two accounts were logged into; one record each came from two other clients, through a vulnerability. The intruder also viewed or took non-public pages of four client companies, with no personal information in them, Basic says. It says no passwords or payment information were viewed or taken, and that it has found no secondary harm so far.

The intruder combined several vulnerabilities in Basic's systems, which Basic says were all fixed by 30 October; it does not describe how the attack worked. Basic now expects the effect on its results to be minor, where the first report said it was being assessed.

Data viewed or taken from ferret One, by Basic's count

Before: No count: login email addresses possibly, the rest under investigationNow: 4,317 login email addresses and 16,970 personal records

What changed

Before Notice of unauthorised access to our service (first report) (filing with the Tokyo Stock Exchange; Internet Archive copy of 5 November), 27 October 2026Now Notice of unauthorised access to our service (second report) (filing with the Tokyo Stock Exchange; Internet Archive copy of 5 November), 4 November 2026

  1. Users' login email addresses

    Before

    May have been viewed or taken; no count; no other registered details such as names

    Now

    4,317 viewed or taken, with the site name registered to each account where one was set

  2. Client companies' personal data

    Before

    Whether anything was viewed or taken through the six accounts: under investigation

    Now

    Lead and inquiry records (names, contact details and the like) of three client companies: 16,968 from one, one each from two others

  3. Client companies' non-public pages

    Before

    Not mentioned

    Now

    Non-public pages of four client companies, including those three, viewed or taken on 16 and 19 October; no personal information in them

  4. The six accounts logged into

    Before

    Six accounts of Basic and of clients

    Now

    Four of Basic's and two of one client's, on the morning of 19 October; through two of Basic's only Basic's own information was reached

  5. Cause

    Before

    A flaw in ferret One's internal management functions; the route and the cause under investigation

    Now

    Several vulnerabilities in Basic's systems, combined; all those exploited fixed by 30 October; how the attack worked not disclosed

  6. Effect on Basic's results

    Before

    Being assessed

    Now

    Expected to be minor

  7. Authorities

    Before

    Relevant bodies informed and consulted, from 27 October

    Now

    Preliminary report to Japan's Personal Information Protection Commission and to the Ministry of Internal Affairs and Communications on 28 October; police being consulted

What stayed the same

  • The account or accounts the intruder created in an internal management function in mid-October (neither report gives a number) were found and deleted on 26 October.
  • Logins to ferret One now need two-step authentication, and the accounts logged into had their passwords reset.

What we don't know yet

  • How many people the records belong to. Basic counts records and email addresses; it removed duplicates only within the one client's lead and inquiry records.
  • Which client companies are affected. Basic says it has told each of the four; neither report names them.
  • Who the intruder is, and how the vulnerabilities were combined. Basic withholds the method so that the attack is not repeated.
  • What the outside investigation Basic plans will find.
Check our translation The changed clauses in the original, beside our English

  1. Login email addresses (27 October)

    ferret Oneをご導入いただいているお客様のログイン用メールアドレスが、閲覧または取得された可能性があります。なお、メールアドレス以外の登録情報（氏名等）は含まれておりません。

    The login email addresses of customers who use ferret One may have been viewed or taken. Registered information other than email addresses (names and the like) is not included.

  2. The six accounts (27 October)

    当該アカウントを通じて閲覧または取得された情報の有無および範囲については、現在調査中です。

    Whether information was viewed or taken through these accounts, and how much, is now being investigated.

  3. The count (4 November)

    本件により、ferret One のログイン用メールアドレス等（4,317 件）と、お客様 3 社が ferret One で管理されていたお問い合わせ等の個人情報（計 16,970 件）が閲覧または取得されたことが判明いたしました。

    It has been found that, in this incident, ferret One login email addresses and related data (4,317) and personal information such as inquiries that three customer companies managed on ferret One (16,970 in total) were viewed or taken.

  4. Non-public pages (4 November)

    このほか、上記３社を含むお客様４社の非公開ページの情報（個人情報は含まれておりません）が閲覧または取得されました。

    Besides this, information on non-public pages of four customer companies, including the three above (containing no personal information), was viewed or taken.

  5. Effect on results (4 November)

    本件が当社の業績に与える影響は軽微と見込んでおります。

    We expect the effect of this incident on our results to be minor.

The documents

For people in the field Identifiers, citations and the trade's shorthand, from the documents
Three routes, per the second report
1, unauthorised login to ferret One (two of Basic's accounts: 4,317 users' login email addresses and site names; two accounts of one client: 16,968 lead and inquiry records, de-duplicated); 2, a vulnerability exploited from those logins (inquiry records of two other clients, one each); 3, a vulnerability exploited without logging in (non-public page information of four clients, no personal information). Basic found route 3 during a review of ferret One after the first report, on 29 October.
Timeline, Japan time, per the second report
13–14 October, accounts created without authorisation in an internal batch-processing management screen; from 13 October, suspicious outside traffic detected and blocked, not then linked to the logins; 16 and 19 October, non-public page information taken; 19 October about 10:03–11:20, the unauthorised logins; 21–27 October, further login attempts, all failed; 26 October, found, accounts deleted, route blocked; 27 October, first report, two-step authentication on for all users; 28 October, login-related flaws fixed, preliminary reports to the Personal Information Protection Commission and the Kanto Bureau of Telecommunications; 30 October, the page-access vulnerability fixed; 4 November, second report.
Company
Basic Inc. (株式会社ベーシック), Tokyo Stock Exchange Growth market, code 519A. Basic says its other services run on systems separate from ferret One and were not affected.