Sakura Internet's investigation expanded from 583 rented-server accounts to a separate sales system holding 1.36 million customer accounts. Access was possible, but data exfiltration was not confirmed.