Sakura Internet, a prominent Japanese cloud and data center service provider, has disclosed that a cybersecurity incident may have exposed data belonging to up to 1,360,563 member accounts. The company, which is a key domestic provider for Japan's Government Cloud program, confirmed that attackers gained access to its sales management system, where customer contract and membership information is stored.
The breach was initially detected on August 9, with Sakura Internet discovering the unauthorized access during an investigation into a separate, less severe incident affecting its Sakura Rental Server service. The rental server breach involved unauthorized logins to 583 accounts, access to customer-facing systems and client data, and the installation of malware onto Sakura's systems. While the company stated it invalidated abused credentials and removed the malware related to the rental server incident, the discovery of the larger sales management system compromise significantly escalates the impact.
Sakura Internet updated its initial notification on Monday, confirming the potential impact on 1,360,563 accounts. The company emphasized that the exact number of affected accounts is still under investigation. While data exfiltration has not been confirmed, Sakura Internet noted that passwords stored in the compromised system are hashed, making them difficult to decipher even if stolen. Furthermore, the company explicitly stated that the affected system does not store any credit card information.
Sakura Internet provides a range of digital infrastructure services, including web hosting, VPS, public cloud, data center, and GPU computing services. Its role in Japan's Government Cloud program underscores its strategic importance in reducing the country's reliance on foreign hyperscalers.
The company has informed relevant authorities about the incident and is in the process of individually notifying affected customers. Details regarding the specific type of malware detected in Sakura's environment have not been disclosed, and the company has not reported any operational or service disruptions as a result of the breach. No ransomware or data extortion groups have publicly claimed responsibility for the attack on Sakura Internet.
