Disk Union Data Breach (2022): What Was Exposed & What To Do

What happened

The breach was reported on June 24, 2022. Public records state that 691,000 individuals were affected. The exposed data included 690,000 unique email addresses together with names, post codes, phone numbers, usernames and passwords stored in plain text. No information has been released on the method of access, the duration of the intrusion or any other technical details.

How a breach like this happens

Incidents involving customer databases at retail organisations often begin with unauthorised access to web servers or internal systems that store account information. Attackers may exploit unpatched software, weak authentication controls or stolen credentials to reach the data. Once inside, they can copy tables containing user records. The presence of plain-text passwords indicates that the stored credentials were not protected by hashing or encryption at the time of the incident.

About Disk Union

Disk Union operates a chain of record stores in Japan specialising in new and used music media. Like other retailers, it maintains customer accounts to support online and in-store purchases, loyalty programmes and communications. Such organisations routinely collect names, contact details, delivery addresses and login credentials to manage transactions and accounts.

What was likely exposed

The reported data types are email addresses, geographic locations in the form of post codes, names, passwords stored in plain text, phone numbers and usernames. The exact contents of the dataset remain unconfirmed beyond these categories. Organisations of this type commonly hold additional fields such as purchase histories or account creation dates, but no further details have been disclosed.

Why it matters

Plain-text passwords can be used directly for attempts to access other online accounts if individuals reuse credentials. Email addresses combined with names and phone numbers increase the precision of phishing or social-engineering attempts. Post codes add location context that could be used for targeted scams. For the organisation, the incident highlights the consequences of storing authentication data without standard protective measures.

If your data was in this breach

Change any password that matches or resembles the one used with Disk Union, especially if it was stored in plain text. Enable multi-factor authentication on accounts that support it and avoid reusing passwords across services. Readers can run a free exposure scan of their email address against known breach data to check for appearances in this or other incidents.

AICompiled with AI assistance from public sources and published under our editorial standards.