MS&AD Insurance Group, one of Japan's largest insurance groups, says the total number of exposed records across its companies has now passed 1 million. On November 9, its subsidiaries Mitsui Sumitomo Insurance and Mitsui Direct General Insurance disclosed about 296,000 more records from two separate incidents. One was a cyberattack on Prestige Core Solution, an outside company that runs roadside assistance services for insurers. The other was unauthorized access to MS Compass, Mitsui Sumitomo's information portal for small and medium-sized businesses. eSecurityPlanet, citing Kyodo News, reports that group companies had already reported about 715,000 records up to November 6. That brings the combined total to about 1.01 million. These counts are records, not people, so the number of individuals affected may be lower. No one has named an attacker, and investigators have not established whether the incidents are linked.
What Happened
The Prestige Core Solution breach. Most of the newly disclosed records came from this vendor. According to Mitsui Sumitomo's November 9 disclosure, as reported by eSecurityPlanet:
- Prestige Core Solution detected unauthorized access on October 29.
- It notified Mitsui Sumitomo on November 4, six days later.
- About 228,000 Mitsui Sumitomo customer records were exposed.
- Including Mitsui Direct customers, the total is about 273,000 records.
The MS&AD Compass portal breach. Mitsui Sumitomo published a separate notice titled "Regarding Information Leakage Due to Unauthorized Access to MS Compass." SmartScope summarises it this way:
- Unauthorized access was detected between November 2 and November 3.
- The company restricted access to part of the system on November 3, then took the entire site offline temporarily.
- About 23,000 records were confirmed leaked as of 9:00 AM on November 9.
- The affected records belong to people who registered as members, signed up for seminars, or used the site's inquiry form.
The two figures together (273,000 plus 23,000) match the roughly 296,000 new records reported on November 9. The group has not given a breakdown of the earlier 715,000 records, and no regulator filing has been published.
What Was Taken
From the roadside assistance vendor, Mitsui Sumitomo says the exposed data included:
- customer names, addresses and phone numbers
- vehicle registration and identification numbers
- possibly other fields; public reporting of the full list is incomplete
From MS Compass, the exposed data included company names, personal names, email addresses, phone numbers, and business details such as sales revenue and number of employees. According to SmartScope's summary of the company notice, credit card and bank account details were not included.
Neither set includes payment data. The risk is that the data is accurate enough to make scams convincing. A caller who knows a customer's name, address, phone number and car registration can pose as the insurer or its roadside service very credibly. Revenue and headcount figures for small businesses help criminals pick targets for invoice fraud.
Why It Matters
- The biggest share came through a vendor. The largest part of this disclosure came from a supplier, not from the insurer's own systems. The same thing happened earlier this year in South Africa: MyBroadband reports that one compromised service provider, MIP Holdings, exposed data belonging to several insurers. MIP said attackers got in through a Jira instance and file-transfer sites, and it named the ransomware group "The Gentlemen."
- There was a six-day gap before the insurer heard. Prestige Core Solution detected the intrusion on October 29 but did not tell Mitsui Sumitomo until November 4. Regulators are tightening timelines. Maryland's insurance regulator reminded carriers in its October 30 Bulletin 26-27 that they must report cybersecurity events within three business days. The rule also covers third-party administrators.
- Financial firms in the region are being hit repeatedly. In the same week, Korean outlet KORInform reported that Mirae Asset Securities suffered two intrusions on consecutive days, exposing data on 39,055 customers and workers.
- The fraud comes after the breach. A Kroll case study describes how an insurance broker's compromised mailbox was used in an attempt to redirect almost £300,000 in client invoice payments. Exposed customer and business contact data is exactly what this kind of fraud relies on.
The Attack Technique
Neither Mitsui Sumitomo nor Prestige Core Solution has said how the attackers got in, which systems were compromised, or whether ransomware was involved. No group has claimed either incident. Investigators have not determined whether the vendor breach and the MS Compass breach are connected.
Without confirmed details, defenders should know about two techniques Microsoft has recently reported against corporate networks and suppliers. Nothing links either one to these incidents.
- AI-driven supply chain attacks. Microsoft says Storm-0940, a group it describes as aligned with the Chinese state, has used an AI tool that automates penetration testing to attack hundreds of organisations since September. Some victims went from first targeting to privileged cloud access in under three hours. In some cases the attackers abused third-party apps that already had access to Microsoft 365.
- Fake help desk calls leading to domain takeover. Microsoft also describes intruders who pose as IT help desk staff on Teams, talk users into allowing a Quick Assist session, and then abuse weaknesses in Active Directory Certificate Services (the ESC1 and ESC8 misconfigurations) to take control of the domain.
What Organizations Should Do
- Write breach-notification deadlines into vendor contracts. Require suppliers that hold your customer data to tell you within 24 to 72 hours of detecting an intrusion. A six-day gap leaves customers exposed to fraud before anyone warns them.
- Keep a list of what customer data each vendor holds. Know exactly which fields each supplier has, so you can work out who is affected and what was exposed within hours instead of days.
- Warn customers before the scammers reach them. Tell affected customers which details were exposed. Remind them that you will never ask for payment or credentials over unsolicited calls, texts or emails, and give them a verified number to call back.
- Lock down portals that are exposed to the internet. Apply rate limiting, bot detection and access monitoring to member and inquiry portals. Delete form submissions and seminar sign-ups once they are no longer needed.
- Make it harder to take over the network. Audit AD CS certificate templates for ESC1 and ESC8 weaknesses. Restrict Quick Assist and similar remote-help tools. Review which third-party apps have been granted access to Microsoft 365 or Graph.
- Require a call back before changing payment details. For any request to change bank details on an invoice, confirm by phone using a number already on file. In the Kroll case, that step stopped the fraud.
Sources: MS&AD Data Breach Exposes Over 1 Million Records | AI-driven, large-scale nation-state campaign using ARTEX ... | From help desk impersonation to AD CS abuse: Investigating ESC1 and... | MS Compass: About 23,000 Records Leaked from Mitsui Sumitomo Insura... | Insurance industry in South Africa under attack and customers are t... | Mirae Asset Securities data breach affects 39,055 people KORInform | Bulletin-26-27 | Insurance Broker BEC Investigation Case Study Kroll