The Dark Fog of the Digital Society! Exposure of 7.1 Million 'Hidden IDs' Sent Externally by LINE GAME: The Excuse That 'It Is Not Personal Information.' Our digital footprints leaked for 4 years. 'Internal identifiers' were continuously sent to external advertising analysis tools for about 4 years in 'LINE PokoPoko, LINE PokoPoko Town, and LINE Pokopang.'

◆ 5 Key Points of the LINE GAME Internal Identifier External Transmission Issue

• External transmission of internal identifiers — LY Corporation announced that 'internal identifiers' of some LINE GAME users were sent to external advertising tools. The period was approximately 4 years, from May 2022 to April 2026.

• 3 affected game titles — Occurred in three titles: 'LINE PokoPoko,' 'LINE PokoPoko Town,' and 'LINE Pokopang.'

• 7.1 million cases leaked — Approximately 7.1 million internal identifiers were sent for logged-in users alone.

• No personal information included — What was sent were internal identifiers consisting of random character strings, which are different from personal information such as LINE IDs. The transmission has already been stopped.

• Cause was insufficient confirmation of settings — The cause was insufficient confirmation by both LY Corporation and the partner company when changing settings for an external tool used by the partner company to analyze ad display status.

Conclusion

This news does not mean that'personal information for 7.1 million people was leaked.'

On the other hand, it indicates a problem with privacy management, in thatinternal identifiers that did not need to be sent externally were being sent to advertising tools for about 4 years.

In other words,

• ❌ It is not a story about names or phone numbers being leaked

• ❌ It is not a story about LINE IDs (for adding friends) being leaked

• ⚠️ It is about identifiers used within LINE being sent to external advertising tools even though it was unnecessary

is the content.

What is an 'internal identifier'?

The article states it is

written as.

For example

3fa7b9d2-8c4e-a12f...

It is a number that is meaningless to humans, such as this.

In the LINE system,

Aさん
↓

内部では

UID = A81F93C0...

it is managed like this.

Even if you look at this number alone,

• name

• phone number

• LINE display name

are usually not identifiable.

Why is this a problem?

This is the important part.

The identifier isnot 'personal information itself.'

However, it becomes'a key to continuously identify the same person.'becomes.

For example,

from the perspective of an advertising company,

UID1234

今日ゲームをした

昨日もゲームをした

広告をクリックした

課金した

all the history is connected like this.

In other words, even if you don't know 'who' it is, you know it is the 'same user.'

If it's not personal information, is it safe?

It cannot be said to be completely safe.

The reason is that identifiers havere-identification risk.

For example, if an advertising company also possesses other data,

UID1234

↓

スマホ情報

↓

広告ID

↓

位置情報

↓

他サービス

and may be combined with other data.

Therefore, the trend worldwide is to treat identifiers as 'personal-related information' as well.

Why did it go unnoticed for four years?

The article states

as the cause.

In other words, when the advertising analysis tool was introduced,

送る情報

・ゲーム開始

・課金

・クリック

だけ送る予定

↓

しかし

内部識別子まで送られていた

↓

誰も確認しなかった

it is believed that this was the state of affairs.

Rather than a program bug, this is

a configuration error, an operational error, and a management error.

What does 7.1 million mean?

This is also a point that is easily misunderstood.

7.1 million refers to identifiers for 7.1 million people.

This is

Aさん

UID123

Bさん

UID456

...

the number of users.

It does not mean 7.1 million passwords or 7.1 million names.

What is the impact?

Based on current information,

what has been confirmed is

• internal identifiers

• Transmission to ad analytics tools

is all it is.

Therefore, at this moment,

• account hijacking

• LINE hijacking

• password leaks

and the like have not been reported.

However, the reason it cannot be taken lightly

Under Europe's GDPR and Japan's Act on the Protection of Personal Information, importance is increasingly placed not only on 'information that can directly identify an individual' but also on 'information that can be linked to an individual when combined with other information.'

Therefore, companies are required to:

• send only the minimum necessary data (data minimization)

• properly configure and manage data according to the purpose of use

• periodically audit the content being sent

is required.

This incident is best understood as a privacy governance issue where 'unnecessary identification information was continuously sent externally' rather than a massive leak of personal information.

+++++++++++++++++
📰 The Dark Fog of the Digital Society! 7.1 Million LINE GAME 'Backdoor IDs' Sent Externally Exposed

The End of the 'Not Personal Information' Excuse: Our Digital Footprints Leaked for 4 Years

LINE Yahoo announced that for some LINE GAME titles ('LINE PokoPoko,' 'LINE Pokopang Town,' and 'LINE Pokopang'), 'internal identifiers' for approximately 7.1 million users had been continuously sent to external ad analytics tools for about four years. The cause was an extremely elementary mistake of 'insufficient verification' by both parties when changing ad settings.

The company emphasizes that 'personal information such as names and phone numbers was not included,' but this is merely an excuse. Every move we made—launching the game, making in-app purchases, and getting absorbed in play—was tagged with an anonymous 'identification code' and continuously scattered as tracking data throughout the digital space.

🔍 'It's safe because names weren't leaked'

• 'Internal Identifiers (UIDs)' are the GPS of the digital society:Random strings like '3fa7b9d2...' may look meaningless at first glance. However, if you perform 'data matching' by combining this with other companies' data (location information, purchase history, search terms), it is easy to pinpoint you as an individual. In the modern age, identifiers are 'quasi-personal information.'

• The death of governance: 'No one was watching for 4 years':The fact that 7.1 million pieces of data continued to leak externally not due to a cyberattack, but simply due to 'insufficient configuration checks.' This is a microcosm of a corporate stance that prioritizes convenience and advertising revenue while putting user privacy protection on the back burner.

• The 'true price' of free games:We think we are enjoying games for 'free,' but we should realize that we are actually paying the price by selling off our most valuable asset: our 'behavioral data.'

⚡ 'No personal information has been leaked'

It is time to wake up.

The essence of the excuse repeated by IT giants that 'no personal information has been leaked' is a defiant stance that says, 'We were secretly selling off your behavioral data right on the edge of what is legally punishable.'

The idea that it is safe as long as names and phone numbers are not leaked is a fossilized thought process from the dawn of the internet. In modern advertising technology, what is most valuable is not the name 'Taro Yamada,' but the raw history of behavior (life logs) itself, such as 'a person with this UID makes in-game purchases for puzzle games at 2 AM and frequently clicks on supplement ads.'

They are trying to brush it off with a single phrase, 'It was a configuration error, we have fixed it,' but the sin of leaving the system that should have been a shield for users wide open for four years for the sake of their own profit (ad optimization) is heavy.

Instead of being fed the sweet nectar of 'convenient and fun free apps,' we have voluntarily entered the cage of a digital surveillance society, and we must now face the foolishness of continuing to tap our smartphones while remaining unaware of this exploitative structure where we continue to provide our every move to companies as 'products.'

7.1 million internal identifiers sent externally by LINE GAME! The inconvenient truth that LINE Yahoo insists does not constitute a personal information leak, and the threat of profiling caused by data leakage to advertising tools. Everything we need to know about data self-defense to survive in a digital surveillance society, including the background of the configuration error left unattended for 4 years and the collapse of privacy management hidden in the terms of service for free apps.