For both the first and second reports, merchants do not need to report to the Personal Information Protection Commission. The leaked personal data does not include any information entrusted to us by merchants.
Why is the data not entrusted by merchants?
The personal data that was leaked (or may have been leaked) was either provided with the individual's consent or obtained and managed by KOMOJU, as a business operator handling personal information, directly from the individual, and does not include any information entrusted to us by merchants. KOMOJU holds and manages it as an independent business operator handling personal information. For example, customers contact us by email or form after agreeing to our privacy policy, so the personal information in their inquiries is obtained by KOMOJU directly from them. The same applies to inquiries from merchants.
Do we need to notify our customers?
No specific action is required from merchants regarding this incident. Merchants have no reporting obligation under the Act on the Protection of Personal Information, and we are contacting the individuals concerned directly. Please make your own decision based on your privacy policy and internal rules.
A customer asked us about this incident
If a customer contacts you, please refer them to our dedicated contact address (security-contact@komoju.com). You can find a message template for customers in A customer asked us about this incident.