World: Subsidiary breach may expose 1.2 million member records

Unauthorized access to Tin Pan Alley's business server occurred on Oct. 17 and was detected on Oct. 28. World isolated the server that day and blocked the access route.

• Around 2:51 p.m. on Oct. 17: An intruder accessed the server from outside and carried out operations to extract data.
• Around 12:08 p.m. on Oct. 28: The unauthorized activity was detected and the server isolated. The access route was blocked by 9:36 p.m.
• After blocking access: World suspended some related internal business systems and confirmed that the blocked route could no longer be used to access them.

World took steps to prevent the damage from spreading, but it is still investigating the potential scope of the leak and identifying affected members. The figure represents cumulative records, not the number of individual members.

The investigation found that some member information may have been disclosed externally. World is continuing to determine which members and how many records are involved.

• Information identified: Members' names, addresses, phone numbers, dates of birth, gender and email addresses.
• Not confirmed at this time: The leak of credit card and other payment information, or facial data.

The possibility of a member data leak puts identifying affected people and notifying them individually in focus. Although no payment information has been confirmed as leaked, the scope could change as the investigation progresses, making further updates from World important.

World has asked outside security experts to investigate and will take steps to prevent a recurrence based on their findings and advice. The impact on earnings is under review.

• Contact with authorities: World consulted police and reported the incident to the Personal Information Protection Commission on Oct. 29.
• Member notifications: World plans to apologize and issue warnings on its website and by individual email. It will provide details once preparations are complete.
• Business impact: World said it will promptly disclose any matters that need to be reported.

If some business systems remain suspended, the effect on internal operations will also need to be assessed. World has not provided an estimate of the financial impact or a timeline for restoring the systems, leaving the investigation's findings and further company announcements as key factors.