Casio Data Breach Exposes Personal Data

Casio, the prominent Japanese electronics manufacturer, has publicly acknowledged and apologized for a significant data breach on its educational web application, ClassPad.net. The breach potentially affects tens of thousands of its customers within Japan and 148 other countries.

Upon detection of the incident on October 11, the company swiftly ascertained that unauthorized access to a ClassPad.net database in its development environment led to the exposure of the personal data of its users. By October 12, it became evident that the data breach wasn't confined to Japan alone — the personal data of customers from other countries had also been accessed.

Casio's investigations revealed that an operational error coupled with inadequate management led to the disabling of certain network security settings in its development environment. This is believed to be the vulnerability that allowed for the breach to occur.

The breached data includes customer names, email addresses, countries of residence, service usage details, and purchase information such as payment methods, license codes, and order details. Thankfully, no credit card data was stored in the compromised database.

Presently, the breached database is now inaccessible to external entities, safeguarding against further unauthorized access. The ClassPad.net app remains uncompromised and operational, as it’s a separate entity from the compromised development database.

Preliminary figures indicate that 91,921 data items pertaining to Japanese customers, including 1,108 educational institution clients, were exposed. An additional 35,049 records of customers from 148 other countries were also accessed. Casio has stated that it will directly contact all potentially affected customers.

On October 16, the company notified Japan's Personal Information Protection Commission and the PrivacyMark certification organization, JUAS, regarding the incident. Casio is also actively collaborating with law enforcement agencies and has sought expertise from external cybersecurity specialists for an in-depth internal investigation.

In addition to immediate rectification measures, the company pledges to amplify its technical safety protocols, bolster security for network pathways and databases, and intensify its safety management strategies through a review of its security operational rules and with the continuation of security training for its employees.