The Ministry of Economy, Trade and Industry (METI) on Friday reprimanded educational services firm Benesse over a data leak that affected more than 20 million people this year.
The ministry ordered Benesse to improve its data protection systems and strengthen oversight and submit a report by Oct 24.
Masaomi Matsuzaki, a systems engineer, was arrested in July for allegedly stealing massive amounts of personal data—including names, addresses, phone numbers and birthdays—multiple times, which he then sold for about 2.5 million yen.
The magnitude of the leak prompted angry calls for an explanation from Benesse, one of the country’s best-known companies.
The firm, whose holdings include the Berlitz language education brand, offers services ranging from teaching babies how to use toys to English instruction.
Benesse confirmed the leak of personal data of at least 7.6 million people, but said the problem could ultimately affect more than 20 million.
However, other details such as credit card numbers, banking data and student performance evaluations were safe, it said.
Matsuzaki was a systems engineer at Benesse affiliate Synform Co when he allegedly copied personal details of customers who had supplied the information to the educational services company, according to police. They said a minimum of 10 million were affected.
The stolen data was sold to at least 10 list brokers, including JustSystems Corp which used it to send ads to Benesse customers.
The theft was discovered when people started receiving phone calls and advertising letters from Benesse rivals that should not have had the information, authorities said.