Key takeaways
- Prestige International's subsidiary Prestige Core Solutions (PCS) runs the system that takes roadside assistance calls and dispatches help for insurers, car leasing companies and others. Attackers got into it on October 29 and took up to 5.5 million records, a count that includes duplicates.
- The records cover customers who used roadside assistance through PCS's clients: names, addresses, phone numbers, email addresses, plate and chassis numbers, accident and breakdown details, and for some, bank account information. No card data has been found.
- Revoking the misused credentials did not stop the attackers. Access continued, and the system was shut down on October 30.
- Four clients have spoken so far: Sony Assurance, AXA General Insurance, ENEOS (car leasing) and Nippon Car Solutions. Their notices differ: ENEOS counts up to 8,500 contracts, the insurers say their exposure is still being checked, and Nippon Car Solutions is the only one to give a cause.
- Most affected people never chose PCS. They bought car insurance or a lease, and the roadside desk behind it belonged to someone else.
What happened#
PCS handles the reception and dispatch of roadside assistance, the service drivers call after a breakdown or accident, on behalf of companies such as non-life insurers and car leasing firms. According to INTERNET Watch, it provides roadside and customer service systems to insurers and to carmakers and dealers.
On October 29, Prestige International detected unauthorized access to the group business system PCS uses for that work, and revoked the credentials that had been misused. The access continued, so it stopped the system on October 30. It has confirmed that customer data from the work PCS does for its clients was taken, is investigating with outside specialists, and is reporting to the Personal Information Protection Commission and consulting the police. Roadside services continue through alternative operations.
Prestige International has not said how the attackers got in. Nippon Car Solutions, one of the clients, has: PCS told it that flaws in the web application's access control and in how credentials were managed led to the access and the theft of data.
What was taken#
| Prestige International (all clients) | |
|---|---|
| Records | Up to about 5.5 million, including duplicates; unique people under review |
| Data | Names, addresses, phone numbers, emails, vehicle information (registration and chassis numbers), accident and breakdown reception details, some bank account information |
| Not found | Card data |
| Also possible | Data on Prestige's partner companies, such as contractors it works with |
What each client has said#
| Company | Business | What it says |
|---|---|---|
| ENEOS | ENEOS Car Lease | Learned on November 2 that its customers' data leaked. Up to 8,500 contracts: names, birth dates, addresses, phone numbers, car model and registration number, lease plan and period. No card, bank or password data. Its own systems were not accessed |
| Nippon Car Solutions | Car leasing and fleet services | Data taken includes names, addresses, phone numbers, emails, vehicle, accident and breakdown information and some account information. Its own scope under review. Gives the cause as reported by PCS |
| Sony Assurance | Car insurance | Told by PCS around 11:00 on October 30. Only roadside cases it sent to PCS may be affected; whether its policyholders' data was taken is still being confirmed. Its roadside service desk is hard to reach by phone because of the incident |
| AXA General Insurance | Car insurance | Its customers' data is in the system; whether it leaked is not yet confirmed |
More clients may follow. Prestige International says it will decide how to notify customers together with each client.
What we don't know yet#
- How many people are affected, once duplicates are removed, and how many belong to each client
- Which other companies use PCS, including carmakers and dealers
- How the attackers got past the system's controls, beyond the "access control and credential management" flaws, and how long they had been inside before October 29
- Why access continued after the credentials were revoked
- Why a roadside assistance system held bank account details, and for whom
- Whether ransom has been demanded. As of November 4, we have not seen Prestige International on leak sites tracked by ransomware.live
Our view#
The vendor nobody chose. A driver who buys car insurance from Sony Assurance or leases a car through ENEOS has no idea that a third company takes their call when the car breaks down, and keeps their address, plate number and accident history. This is the same shape as this autumn's email delivery service breaches: one contractor serving many brands, one system holding all their customers, and one intrusion that reaches them all.
The client gave the cause, not the vendor. Prestige International's notice describes what was taken but not how. Nippon Car Solutions' notice, published the same day, passes on what PCS told it: flaws in access control and credential management. When the most useful technical detail comes from a client's notice, the vendor is not leading the disclosure. Clients, for their part, publish different facts at different times, which leaves people who hold policies with more than one company comparing notices.
This data is made for convincing fraud. A caller who knows your name, address, car, plate number and the date of your last breakdown can pose as your insurer very easily. The bank account details, where included, add a reason to ask for "refund" or "claim" details. Every company involved warns customers about fake calls and messages, and that warning is the most important part of their notices.
The service matters too. Roadside assistance is what stranded drivers rely on. Sony Assurance says its road service desk is hard to reach by phone because of the incident, and asks customers who arrange help themselves to keep receipts. Prestige International says services continue through alternative operations. For outsourced services that people need in an emergency, how the vendor keeps working during an incident deserves as much attention as the data.
What this means for practitioners#
- Map the vendors behind customer-facing services. Roadside, call center and claims vendors hold rich customer data. Know which ones you use, what they keep and in which system.
- Limit what the vendor keeps. Ask whether each data item, such as birth dates or bank accounts, is needed for the work, and how long records are kept. A count of 5.5 million records with duplicates suggests a long history.
- Ask about segregation. Find out whether your customers' data sits in the same system and access paths as other clients'.
- Agree on disclosure in advance. Contracts should cover how fast the vendor tells you, what it tells you about the cause and scope, and who notifies customers. Coordinate wording so that customers get consistent facts.
- Plan for the service, not only the data. Check how the vendor will keep an emergency service running, and how you will reroute customers, if its system is taken offline.
- Warn customers about impersonation early, with the specific data that leaked, so they can recognize a call that uses it.
Japanese terms at a glance#
| Japanese | Reading | Meaning |
|---|---|---|
| ロードサービス | rōdo sābisu | Roadside assistance |
| 受付・手配業務 | uketsuke / tehai gyōmu | Reception and dispatch work |
| 委託先 | itakusaki | Contractor, vendor |
| 提携業者 | teikei gyōsha | Partner company |
| 車台番号 | shadai bangō | Chassis number (VIN equivalent) |
| 登録番号 | tōroku bangō | Registration (plate) number |
| 持ち出し | mochidashi | Taking data out, exfiltration |
| 代替の運用 | daitai no un'yō | Alternative operations |
| アクセス制御 | akusesu seigyo | Access control |