Guidance on Responding to Personal Information Leaks
Overview
The Information-technology Promotion Agency (IPA), an independent administrative agency, explains how people affected by personal information leaks can identify the types of information exposed, take necessary steps, and reduce the risk of secondary harm. It describes the risks and responses for IDs and passwords, credit card information, contact details and names, and identity verification documents. It also outlines steps everyone can take routinely, regardless of whether they were affected, and provides a consultation service.
Key points
- When information is leaked, first identify its type and then take the appropriate steps.
- Routine measures include using strong passwords, multi-factor authentication or passkeys, watching for fraudulent emails and similar threats, and minimizing the information provided when registering.
- People with concerns or questions can contact the IPA Information Security Consultation Service by phone or email.
Overview
Against a backdrop of repeated announcements of information leaks caused by unauthorized access and inquiries from general users about how to respond, the Information-technology Promotion Agency (IPA) explains how to limit secondary harm and what measures to take routinely.
Details
If you are affected by a leak, identify the exposed information through a notice from the service provider, information on its website, or an inquiry to its support desk, then take steps appropriate to each type. Change leaked IDs and passwords promptly and make passwords long and complex. Change them on any other services where you used the same password. If credit card information was exposed, contact the card issuer to check for unauthorized use and discuss suspending or reissuing the card; check your statements regularly for the time being.
If your email address, phone number, address, or name was exposed, watch out for fraudulent emails and text messages, scam calls, and suspicious mail. Treat unexpected emails and text messages as scams: ignore or delete them, and do not open links, enter information on websites, or install apps. Do not accept suspicious mail that requires payment on delivery. If an image of an identity verification document was exposed, the article says that filing a self-report with a credit information agency can help deter unauthorized use and contracts you do not recognize. It refers readers to the Japan Credit Information Reference Center Corporation (JICC), Credit Information Center Corp. (CIC), and the Japanese Bankers Association's Personal Credit Information Center (KSC).
As routine practice, use long, complex passwords without reusing them, and use multi-factor authentication or passkeys. Watch for fraudulent emails and similar threats, and verify their authenticity by contacting the service through its official website. Provide only the minimum information needed when registering for services. Before deleting an unused account, check the terms of service and privacy policy for information about deleting your data. The consultation service accepts inquiries by phone or email.