Japan: Issued PPC summary of improvements made by LINE after a personal information breach

On 24 July 2024, the Japanese Personal Information Protection Committee (PPC) published a summary of the progress made in response to recommendations given to LINE Yahoo following a personal information breach. The incident occurred when a computer used by an employee of a Korean company, a contractor of LY Corporation, became infected with malware, leading to unauthorized access to LY Corporation's information system and resulting in the leakage of personal data related to LINE. As of 26 April 2024, LY Corporation reported some advancements, including the implementation of two-factor authentication and the installation of firewalls between LY and NAVER Cloud (NC) data centres. However, on 22 May 2024, the PPC noted that several security enhancements remained incomplete or were still in the planning stages and required LY to expedite improvements. Upon investigating again after the deadline for those improvements had passed, the PPC noted progress, including the expedited separation of systems from the NAVER group and NAVER Cloud Corporation (NC) and the development of plans to terminate or reduce outsourced operations to NAVER and NC. Other improvement measures were also advancing satisfactorily. For those measures still in progress, LY is required to report the status of their implementation by 30 September 2024.